@roamcode.ai/server 1.1.0 → 1.3.0

package/dist/index.d.ts

@@ -95,7 +95,7 @@ interface ServerRuntimeConfig {
     dataDir: string;
     /**
      * Trust X-Forwarded-* (passed to Fastify as `trustProxy`). Default false. PREFER a specific proxy IP/CIDR
-     * (e.g. "127.0.0.1" for a same-host cloudflared/Caddy) over `true`: `true` trusts EVERY hop and takes the
+     * (e.g. "127.0.0.1" for a same-host Caddy process) over `true`: `true` trusts EVERY hop and takes the
      * left-most XFF entry, which a client can prepend to spoof `request.ip` and poison the rate limiter. A
      * string here is Fastify's trustProxy spec (IP, CIDR, or comma-list); boolean true = trust all hops.
      */
@@ -171,7 +171,7 @@ type AuthCheckResult = {
  * WebSocket upgrade.
  *
  * Proxy lockout caveat: the lockout is keyed by `clientKey` (`request.ip`).
- * Behind a reverse proxy (Caddy / Cloudflare) `request.ip` is the proxy's IP
+ * Behind a reverse proxy, `request.ip` is the proxy's IP
  * for EVERY client, collapsing the per-client lockout to one shared key. To
  * stop that from self-DoS-ing the sole legitimate user, {@link check} validates
  * the token FIRST: a CORRECT token is ALWAYS accepted, even while its key is
@@ -663,10 +663,10 @@ declare function ensureDataDir(dir: string): void;
  */
 declare function generateAccessToken(): string;
 /**
- * Persist a token to `<dataDir>/token` with mode 0600 (overwriting any prior file). Used by both first-run
- * generation and POST /token/rotate. `writeFileSync`'s `mode` is honored only when CREATING a file, so we
- * chmod unconditionally afterwards — a rotated secret can never land in a too-permissive (e.g. world-
- * readable) file left behind by an earlier write.
+ * Persist a token to `<dataDir>/token` with mode 0600 (atomically replacing any prior regular file). Used by
+ * POST /token/rotate and access reset. The secret is fsynced before rename, and the containing directory is
+ * fsynced afterwards; a crash can expose either the complete old token or the complete new token, never a
+ * truncated intermediate value.
  */
 declare function persistAccessToken(dataDir: string, token: string): void;
 interface ResolveAccessTokenOptions {
@@ -726,21 +726,87 @@ interface RelayPairingTicket extends PairingTicket {
     deviceId: string;
     token: string;
 }
+interface RelayPairingCancellationReservation {
+    deviceId: string;
+    reservationId: string;
+}
+type RelayPairingCancellationStart = {
+    status: "reserved";
+    reservation: RelayPairingCancellationReservation;
+} | {
+    status: "busy";
+} | {
+    status: "missing";
+};
 interface DeviceEnrollment {
     /** The per-device bearer credential. Returned once; only its SHA-256 digest is persisted. */
     token: string;
     device: DeviceInfo;
 }
+type CloudDeviceEnrollmentState = "prepared" | "local-finalized" | "cloud-report-pending" | "complete" | "revoked";
+interface CloudDeviceEnrollmentPrepareInput {
+    enrollmentId: string;
+    deviceId: string;
+    challenge: string;
+    name: string;
+    token: string;
+    relayIdentityPublicKey: string;
+    durableRelayCredentialHash: string;
+}
+interface CloudDeviceEnrollmentProgress {
+    enrollmentId: string;
+    deviceId: string;
+    state: CloudDeviceEnrollmentState;
+    durableRelayCredentialHash: string;
+    temporaryRelayCredentialHash?: string;
+    controlPlaneDeviceId?: string;
+    device?: DeviceInfo;
+}
+interface PendingCloudDevicePromotion {
+    enrollmentId: string;
+    deviceId: string;
+    expectedCredentialHash: string;
+    credentialHash: string;
+    controlPlaneDeviceId: string;
+    brokerPromoted: boolean;
+}
+declare class CloudDeviceEnrollmentConflictError extends Error {
+    constructor();
+}
 interface DeviceStore {
     readonly mode: "sqlite" | "memory-fallback";
     issuePairing(now?: number, scopes?: DeviceScope[]): PairingTicket;
+    cancelPairing(secret: string): boolean;
     claimPairing(secret: string, name: string, now?: number, relayIdentityPublicKey?: string): DeviceEnrollment | undefined;
     issueRelayPairing(now?: number): RelayPairingTicket;
     pendingRelayPairing(deviceId: string, now?: number): boolean;
+    /** Atomically prevents a relay claim from winning while broker revocation is in flight. */
+    beginRelayPairingCancellation(deviceId: string, now?: number): RelayPairingCancellationStart;
+    /** Release a failed broker-revocation attempt so the same expiry-bounded link can be retried. */
+    releaseRelayPairingCancellation(reservation: RelayPairingCancellationReservation): boolean;
+    /** Delete the local bootstrap only after broker revocation is authoritative. */
+    finishRelayPairingCancellation(reservation: RelayPairingCancellationReservation): boolean;
+    cancelRelayPairing(deviceId: string): boolean;
     claimRelayPairing(secret: string, token: string, name: string, relayIdentityPublicKey: string, now?: number): DeviceEnrollment | undefined;
     /** Resolve a per-device bearer credential and best-effort touch its last-seen time. */
     authenticate(token: string, now?: number, requiredScope?: DeviceScope): DeviceInfo | undefined;
     relayIdentity(id: string): DeviceRelayIdentity | undefined;
+    /** Persist only digests before contacting the control plane; exact replays resume the same saga. */
+    beginCloudDeviceEnrollment(input: CloudDeviceEnrollmentPrepareInput, now?: number): CloudDeviceEnrollmentProgress;
+    /** Atomically inserts the canonical relay actor and advances the saga after control-plane confirmation. */
+    finalizeCloudDeviceEnrollment(enrollmentId: string, temporaryRelayCredentialHash: string, controlPlaneDeviceId: string, now?: number): CloudDeviceEnrollmentProgress;
+    /** Persist the successful broker CAS before the control-plane completion report is attempted. */
+    markCloudDeviceEnrollmentPromoted(enrollmentId: string, expectedCredentialHash: string, credentialHash: string, now?: number): CloudDeviceEnrollmentProgress;
+    /** Marks activation durable only after the broker CAS and control-plane report both commit. */
+    completeCloudDeviceEnrollment(enrollmentId: string, expectedCredentialHash: string, credentialHash: string, now?: number): CloudDeviceEnrollmentProgress;
+    /** Tombstone a control-plane-revoked enrollment and remove its still-inert local actor. */
+    revokeCloudDeviceEnrollment(enrollmentId: string, controlPlaneDeviceId: string, expectedCredentialHash: string, credentialHash: string, now?: number): CloudDeviceEnrollmentProgress;
+    /** Pending local actors must not normal-auth until broker promotion and a fresh cloud grant both commit. */
+    cloudDeviceEnrollmentPending(deviceId: string): boolean;
+    /** Return a bounded, oldest-attempted-first recovery page without materializing the full queue. */
+    pendingCloudDevicePromotions(now?: number, limit?: number): PendingCloudDevicePromotion[];
+    /** Move an exact still-pending promotion behind other queued work after a failed recovery attempt. */
+    deferCloudDevicePromotion(enrollmentId: string, expectedCredentialHash: string, credentialHash: string, now?: number): boolean;
     list(): DeviceInfo[];
     rename(id: string, name: string): DeviceInfo | undefined;
     revoke(id: string): boolean;
@@ -753,6 +819,8 @@ interface OpenDeviceStoreOptions {
     generateSecret?: () => string;
     generateToken?: () => string;
     generateId?: () => string;
+    /** Test/portable hook; a loader failure selects the bounded in-memory fallback. */
+    loadDatabase?: () => typeof better_sqlite3;
 }
 declare function normalizeDeviceScopes(value: unknown): DeviceScope[] | undefined;
 /** Keep device labels useful in UI while refusing control characters and unbounded payloads. */
@@ -846,10 +914,10 @@ declare class InputLeaseCoordinator {
 type TeamStoreMode = "sqlite" | "memory-fallback";
 type TeamMemberKind = "person" | "service";
 type TeamMemberStatus = "active" | "suspended" | "removed";
-type TeamRole = "viewer" | "operator" | "workspace-manager" | "extension-manager" | "policy-admin" | "organization-admin";
+type TeamRole = "viewer" | "operator" | "node-admin" | "workspace-manager" | "extension-manager" | "policy-admin" | "organization-admin";
 type TeamScopeType = "team" | "host" | "workspace";
 type TeamPrincipalType = "device" | "host" | "local" | "relay";
-type TeamPermission = "team:read" | "sessions:read" | "sessions:operate" | "attention:read" | "attention:manage" | "presence:read" | "presence:write" | "workspaces:manage" | "extensions:manage" | "policy:manage" | "members:manage" | "audit:read" | "fleet:read";
+type TeamPermission = "team:read" | "sessions:read" | "sessions:operate" | "attention:read" | "attention:manage" | "presence:read" | "presence:write" | "workspaces:manage" | "extensions:manage" | "policy:manage" | "members:manage" | "node-access:manage" | "audit:read" | "fleet:read";
 interface TeamRecord {
     id: string;
     name: string;
@@ -928,6 +996,11 @@ interface TeamStore {
         scopeType?: TeamScopeType;
         scopeId?: string;
     }, now?: number): TeamRoleBinding;
+    setNodeAccessRole(input: {
+        memberId: string;
+        nodeId: string;
+        role: "viewer" | "operator" | "node-admin";
+    }, now?: number): TeamRoleBinding;
     revokeRole(id: string, now?: number): boolean;
     listPrincipalBindings(memberId?: string): TeamPrincipalBinding[];
     bindPrincipal(input: {
@@ -1226,13 +1299,24 @@ interface RelayAccountRecord {
     createdAt: number;
     updatedAt: number;
 }
-interface CreateRelayAccountInput {
+interface RelayAccountFields {
+    /** Stable control-plane identity. Omit for the legacy server-generated account flow. */
+    id?: string;
     label: string;
-    credential: string;
     plan?: RelayAccountPlan;
     maxRoutes?: number;
     maxDevicesPerRoute?: number;
 }
+interface RelayAccountCredentialMaterial {
+    credentialHash: string;
+    credentialLookup: string;
+}
+type CreateRelayAccountInput = RelayAccountFields & (({
+    credential: string;
+} & Partial<Record<keyof RelayAccountCredentialMaterial, never>>) | ({
+    credential?: never;
+} & RelayAccountCredentialMaterial));
+type RelayAccountCredentialInput = string | RelayAccountCredentialMaterial;
 interface UpdateRelayAccountInput {
     label?: string;
     status?: RelayAccountStatus;
@@ -1247,9 +1331,13 @@ interface RelayAccountStore {
     listAccounts(options?: {
         includeDeleted?: boolean;
     }): RelayAccountRecord[];
+    /** Verify ownership for recovery without granting a suspended account route access. */
+    verifyCredential(credential: string): RelayAccountRecord | undefined;
     authenticate(credential: string): RelayAccountRecord | undefined;
+    /** Constant-time comparison for idempotent control-plane provisioning and credential rotation. */
+    credentialMatches(id: string, credential: RelayAccountCredentialInput): boolean;
     updateAccount(id: string, input: UpdateRelayAccountInput, expectedRevision: number, now?: number): RelayAccountRecord | undefined;
-    rotateCredential(id: string, credential: string, expectedRevision: number, now?: number): RelayAccountRecord | undefined;
+    rotateCredential(id: string, credential: RelayAccountCredentialInput, expectedRevision: number, now?: number): RelayAccountRecord | undefined;
     close(): void;
 }
 interface OpenRelayAccountStoreOptions {
@@ -1268,7 +1356,8 @@ declare function openRelayAccountStore(options: OpenRelayAccountStoreOptions): R
 
 interface RelayDeviceProvisioner {
     putDevice(deviceId: string, credentialHash: string, expiresAt?: number): Promise<void>;
-    revokeDevice(deviceId: string): Promise<void>;
+    promoteDevice(deviceId: string, expectedCredentialHash: string, credentialHash: string): Promise<void>;
+    revokeDevice(deviceId: string, expectedCredentialHash?: string): Promise<void>;
 }
 interface RelayDeviceProvisionerOptions {
     relayUrl: string;
@@ -1304,11 +1393,14 @@ interface RelayPairingBootstrap {
     generateDeviceCredential?: () => string;
 }
 declare function normalizeRelayAppUrl(value: string): string;
-declare function buildRelayPairingUrl(appUrl: string, pairing: RelayPairingPackage): string;
+declare function buildRelayPairingUrl(appUrl: string, pairing: RelayPairingPackage, options?: {
+    hostedApp?: boolean;
+}): string;
 
 declare const BLIND_RELAY_PROTOCOL_VERSION: 1;
 declare const BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES = 1500000;
 declare const BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES = 4000000;
+declare const BLIND_RELAY_DEFAULT_MAX_TOTAL_CONNECTIONS = 1024;
 declare const BLIND_RELAY_DEFAULT_MAX_CONNECTIONS_PER_ROUTE = 64;
 declare const BLIND_RELAY_DEFAULT_MAX_BYTES_PER_MINUTE: number;
 declare const BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE = 12000;
@@ -1324,6 +1416,7 @@ interface CreateBlindRelayOptions {
     idleTimeoutMs?: number;
     maxFrameBytes?: number;
     maxQueueBytes?: number;
+    maxTotalConnections?: number;
     maxConnectionsPerRoute?: number;
     maxBytesPerMinute?: number;
     maxMessagesPerMinute?: number;
@@ -1331,6 +1424,7 @@ interface CreateBlindRelayOptions {
     generateChannelId?: () => string;
 }
 interface BlindRelayMetrics {
+    activeConnections: number;
     activeHosts: number;
     activeDevices: number;
     acceptedConnections: number;
@@ -1378,6 +1472,711 @@ declare function relayRpcResponse(input: {
     body?: Uint8Array;
 }): RelayRpcResponse;
 
+declare const CLOUD_CONTRACT_VERSION: 1;
+declare const CLOUD_AUTHORIZATION_CONTRACT_VERSION: 2;
+declare const CLOUD_AUTHORIZATION_SIGNATURE_ALGORITHM: "Ed25519";
+declare const CLOUD_AUTHORIZATION_SIGNATURE_ALGORITHM_V2: "Ed25519-SHA256";
+declare const CLOUD_AUTHORIZATION_SIGNATURE_DOMAIN = "roamcode-cloud-authorization-snapshot-v1";
+declare const CLOUD_AUTHORIZATION_SIGNATURE_DOMAIN_V2 = "roamcode-cloud-authorization-snapshot-v2";
+declare const CLOUD_AUTHORIZATION_PERMISSIONS: readonly ["team:read", "sessions:read", "sessions:operate", "attention:read", "attention:manage", "presence:read", "presence:write", "workspaces:manage", "extensions:manage", "policy:manage", "members:manage", "node-access:manage", "audit:read", "fleet:read"];
+declare const CloudRelayHostIdentitySchema: z.ZodObject<{
+    publicKey: z.ZodString;
+    fingerprint: z.ZodString;
+}, z.core.$strict>;
+declare const CloudAuthorizationPermissionSchema: z.ZodEnum<{
+    "team:read": "team:read";
+    "sessions:read": "sessions:read";
+    "sessions:operate": "sessions:operate";
+    "attention:read": "attention:read";
+    "attention:manage": "attention:manage";
+    "presence:read": "presence:read";
+    "presence:write": "presence:write";
+    "workspaces:manage": "workspaces:manage";
+    "extensions:manage": "extensions:manage";
+    "policy:manage": "policy:manage";
+    "members:manage": "members:manage";
+    "node-access:manage": "node-access:manage";
+    "audit:read": "audit:read";
+    "fleet:read": "fleet:read";
+}>;
+declare const CloudHostHeartbeatV1Schema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"host-heartbeat">;
+    organizationId: z.ZodString;
+    hostId: z.ZodString;
+    instanceId: z.ZodString;
+    sentAt: z.ZodNumber;
+    sequence: z.ZodNumber;
+    softwareVersion: z.ZodString;
+    state: z.ZodEnum<{
+        ready: "ready";
+        draining: "draining";
+    }>;
+    authorizationRevision: z.ZodNullable<z.ZodNumber>;
+    relayHostIdentity: z.ZodOptional<z.ZodObject<{
+        publicKey: z.ZodString;
+        fingerprint: z.ZodString;
+    }, z.core.$strict>>;
+    capabilities: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+declare const CloudAuthorizationScopeV1Schema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"organization">;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"host">;
+    id: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"workspace">;
+    id: z.ZodString;
+}, z.core.$strict>], "type">;
+declare const CloudAuthorizationGrantV1Schema: z.ZodObject<{
+    principalType: z.ZodEnum<{
+        device: "device";
+        relay: "relay";
+    }>;
+    principalId: z.ZodString;
+    permissions: z.ZodArray<z.ZodEnum<{
+        "team:read": "team:read";
+        "sessions:read": "sessions:read";
+        "sessions:operate": "sessions:operate";
+        "attention:read": "attention:read";
+        "attention:manage": "attention:manage";
+        "presence:read": "presence:read";
+        "presence:write": "presence:write";
+        "workspaces:manage": "workspaces:manage";
+        "extensions:manage": "extensions:manage";
+        "policy:manage": "policy:manage";
+        "members:manage": "members:manage";
+        "node-access:manage": "node-access:manage";
+        "audit:read": "audit:read";
+        "fleet:read": "fleet:read";
+    }>>;
+    scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"organization">;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"host">;
+        id: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"workspace">;
+        id: z.ZodString;
+    }, z.core.$strict>], "type">;
+}, z.core.$strict>;
+declare const CloudAuthorizationSnapshotV1Schema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"authorization-snapshot">;
+    organizationId: z.ZodString;
+    hostId: z.ZodString;
+    revision: z.ZodNumber;
+    issuedAt: z.ZodNumber;
+    notBefore: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+    grants: z.ZodArray<z.ZodObject<{
+        principalType: z.ZodEnum<{
+            device: "device";
+            relay: "relay";
+        }>;
+        principalId: z.ZodString;
+        permissions: z.ZodArray<z.ZodEnum<{
+            "team:read": "team:read";
+            "sessions:read": "sessions:read";
+            "sessions:operate": "sessions:operate";
+            "attention:read": "attention:read";
+            "attention:manage": "attention:manage";
+            "presence:read": "presence:read";
+            "presence:write": "presence:write";
+            "workspaces:manage": "workspaces:manage";
+            "extensions:manage": "extensions:manage";
+            "policy:manage": "policy:manage";
+            "members:manage": "members:manage";
+            "node-access:manage": "node-access:manage";
+            "audit:read": "audit:read";
+            "fleet:read": "fleet:read";
+        }>>;
+        scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"organization">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"host">;
+            id: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"workspace">;
+            id: z.ZodString;
+        }, z.core.$strict>], "type">;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+declare const CloudAuthorizationSnapshotV2Schema: z.ZodObject<{
+    v: z.ZodLiteral<2>;
+    kind: z.ZodLiteral<"authorization-snapshot">;
+    organizationId: z.ZodString;
+    hostId: z.ZodString;
+    revision: z.ZodNumber;
+    issuedAt: z.ZodNumber;
+    notBefore: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+    grants: z.ZodArray<z.ZodObject<{
+        principalType: z.ZodEnum<{
+            device: "device";
+            relay: "relay";
+        }>;
+        principalId: z.ZodString;
+        permissions: z.ZodArray<z.ZodEnum<{
+            "team:read": "team:read";
+            "sessions:read": "sessions:read";
+            "sessions:operate": "sessions:operate";
+            "attention:read": "attention:read";
+            "attention:manage": "attention:manage";
+            "presence:read": "presence:read";
+            "presence:write": "presence:write";
+            "workspaces:manage": "workspaces:manage";
+            "extensions:manage": "extensions:manage";
+            "policy:manage": "policy:manage";
+            "members:manage": "members:manage";
+            "node-access:manage": "node-access:manage";
+            "audit:read": "audit:read";
+            "fleet:read": "fleet:read";
+        }>>;
+        scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"organization">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"host">;
+            id: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"workspace">;
+            id: z.ZodString;
+        }, z.core.$strict>], "type">;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+declare const CloudAuthorizationSnapshotSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"authorization-snapshot">;
+    organizationId: z.ZodString;
+    hostId: z.ZodString;
+    revision: z.ZodNumber;
+    issuedAt: z.ZodNumber;
+    notBefore: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+    grants: z.ZodArray<z.ZodObject<{
+        principalType: z.ZodEnum<{
+            device: "device";
+            relay: "relay";
+        }>;
+        principalId: z.ZodString;
+        permissions: z.ZodArray<z.ZodEnum<{
+            "team:read": "team:read";
+            "sessions:read": "sessions:read";
+            "sessions:operate": "sessions:operate";
+            "attention:read": "attention:read";
+            "attention:manage": "attention:manage";
+            "presence:read": "presence:read";
+            "presence:write": "presence:write";
+            "workspaces:manage": "workspaces:manage";
+            "extensions:manage": "extensions:manage";
+            "policy:manage": "policy:manage";
+            "members:manage": "members:manage";
+            "node-access:manage": "node-access:manage";
+            "audit:read": "audit:read";
+            "fleet:read": "fleet:read";
+        }>>;
+        scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"organization">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"host">;
+            id: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"workspace">;
+            id: z.ZodString;
+        }, z.core.$strict>], "type">;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    v: z.ZodLiteral<2>;
+    kind: z.ZodLiteral<"authorization-snapshot">;
+    organizationId: z.ZodString;
+    hostId: z.ZodString;
+    revision: z.ZodNumber;
+    issuedAt: z.ZodNumber;
+    notBefore: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+    grants: z.ZodArray<z.ZodObject<{
+        principalType: z.ZodEnum<{
+            device: "device";
+            relay: "relay";
+        }>;
+        principalId: z.ZodString;
+        permissions: z.ZodArray<z.ZodEnum<{
+            "team:read": "team:read";
+            "sessions:read": "sessions:read";
+            "sessions:operate": "sessions:operate";
+            "attention:read": "attention:read";
+            "attention:manage": "attention:manage";
+            "presence:read": "presence:read";
+            "presence:write": "presence:write";
+            "workspaces:manage": "workspaces:manage";
+            "extensions:manage": "extensions:manage";
+            "policy:manage": "policy:manage";
+            "members:manage": "members:manage";
+            "node-access:manage": "node-access:manage";
+            "audit:read": "audit:read";
+            "fleet:read": "fleet:read";
+        }>>;
+        scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"organization">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"host">;
+            id: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"workspace">;
+            id: z.ZodString;
+        }, z.core.$strict>], "type">;
+    }, z.core.$strict>>;
+}, z.core.$strict>], "v">;
+declare const SignedCloudAuthorizationSnapshotV1Schema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"signed-authorization-snapshot">;
+    algorithm: z.ZodLiteral<"Ed25519">;
+    keyId: z.ZodString;
+    snapshot: z.ZodObject<{
+        v: z.ZodLiteral<1>;
+        kind: z.ZodLiteral<"authorization-snapshot">;
+        organizationId: z.ZodString;
+        hostId: z.ZodString;
+        revision: z.ZodNumber;
+        issuedAt: z.ZodNumber;
+        notBefore: z.ZodNumber;
+        expiresAt: z.ZodNumber;
+        grants: z.ZodArray<z.ZodObject<{
+            principalType: z.ZodEnum<{
+                device: "device";
+                relay: "relay";
+            }>;
+            principalId: z.ZodString;
+            permissions: z.ZodArray<z.ZodEnum<{
+                "team:read": "team:read";
+                "sessions:read": "sessions:read";
+                "sessions:operate": "sessions:operate";
+                "attention:read": "attention:read";
+                "attention:manage": "attention:manage";
+                "presence:read": "presence:read";
+                "presence:write": "presence:write";
+                "workspaces:manage": "workspaces:manage";
+                "extensions:manage": "extensions:manage";
+                "policy:manage": "policy:manage";
+                "members:manage": "members:manage";
+                "node-access:manage": "node-access:manage";
+                "audit:read": "audit:read";
+                "fleet:read": "fleet:read";
+            }>>;
+            scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"organization">;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"host">;
+                id: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"workspace">;
+                id: z.ZodString;
+            }, z.core.$strict>], "type">;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    signature: z.ZodString;
+}, z.core.$strict>;
+declare const SignedCloudAuthorizationSnapshotV2Schema: z.ZodObject<{
+    v: z.ZodLiteral<2>;
+    kind: z.ZodLiteral<"signed-authorization-snapshot">;
+    algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+    keyId: z.ZodString;
+    snapshot: z.ZodObject<{
+        v: z.ZodLiteral<2>;
+        kind: z.ZodLiteral<"authorization-snapshot">;
+        organizationId: z.ZodString;
+        hostId: z.ZodString;
+        revision: z.ZodNumber;
+        issuedAt: z.ZodNumber;
+        notBefore: z.ZodNumber;
+        expiresAt: z.ZodNumber;
+        grants: z.ZodArray<z.ZodObject<{
+            principalType: z.ZodEnum<{
+                device: "device";
+                relay: "relay";
+            }>;
+            principalId: z.ZodString;
+            permissions: z.ZodArray<z.ZodEnum<{
+                "team:read": "team:read";
+                "sessions:read": "sessions:read";
+                "sessions:operate": "sessions:operate";
+                "attention:read": "attention:read";
+                "attention:manage": "attention:manage";
+                "presence:read": "presence:read";
+                "presence:write": "presence:write";
+                "workspaces:manage": "workspaces:manage";
+                "extensions:manage": "extensions:manage";
+                "policy:manage": "policy:manage";
+                "members:manage": "members:manage";
+                "node-access:manage": "node-access:manage";
+                "audit:read": "audit:read";
+                "fleet:read": "fleet:read";
+            }>>;
+            scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"organization">;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"host">;
+                id: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"workspace">;
+                id: z.ZodString;
+            }, z.core.$strict>], "type">;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    signature: z.ZodString;
+}, z.core.$strict>;
+declare const SignedCloudAuthorizationSnapshotSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"signed-authorization-snapshot">;
+    algorithm: z.ZodLiteral<"Ed25519">;
+    keyId: z.ZodString;
+    snapshot: z.ZodObject<{
+        v: z.ZodLiteral<1>;
+        kind: z.ZodLiteral<"authorization-snapshot">;
+        organizationId: z.ZodString;
+        hostId: z.ZodString;
+        revision: z.ZodNumber;
+        issuedAt: z.ZodNumber;
+        notBefore: z.ZodNumber;
+        expiresAt: z.ZodNumber;
+        grants: z.ZodArray<z.ZodObject<{
+            principalType: z.ZodEnum<{
+                device: "device";
+                relay: "relay";
+            }>;
+            principalId: z.ZodString;
+            permissions: z.ZodArray<z.ZodEnum<{
+                "team:read": "team:read";
+                "sessions:read": "sessions:read";
+                "sessions:operate": "sessions:operate";
+                "attention:read": "attention:read";
+                "attention:manage": "attention:manage";
+                "presence:read": "presence:read";
+                "presence:write": "presence:write";
+                "workspaces:manage": "workspaces:manage";
+                "extensions:manage": "extensions:manage";
+                "policy:manage": "policy:manage";
+                "members:manage": "members:manage";
+                "node-access:manage": "node-access:manage";
+                "audit:read": "audit:read";
+                "fleet:read": "fleet:read";
+            }>>;
+            scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"organization">;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"host">;
+                id: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"workspace">;
+                id: z.ZodString;
+            }, z.core.$strict>], "type">;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    signature: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    v: z.ZodLiteral<2>;
+    kind: z.ZodLiteral<"signed-authorization-snapshot">;
+    algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+    keyId: z.ZodString;
+    snapshot: z.ZodObject<{
+        v: z.ZodLiteral<2>;
+        kind: z.ZodLiteral<"authorization-snapshot">;
+        organizationId: z.ZodString;
+        hostId: z.ZodString;
+        revision: z.ZodNumber;
+        issuedAt: z.ZodNumber;
+        notBefore: z.ZodNumber;
+        expiresAt: z.ZodNumber;
+        grants: z.ZodArray<z.ZodObject<{
+            principalType: z.ZodEnum<{
+                device: "device";
+                relay: "relay";
+            }>;
+            principalId: z.ZodString;
+            permissions: z.ZodArray<z.ZodEnum<{
+                "team:read": "team:read";
+                "sessions:read": "sessions:read";
+                "sessions:operate": "sessions:operate";
+                "attention:read": "attention:read";
+                "attention:manage": "attention:manage";
+                "presence:read": "presence:read";
+                "presence:write": "presence:write";
+                "workspaces:manage": "workspaces:manage";
+                "extensions:manage": "extensions:manage";
+                "policy:manage": "policy:manage";
+                "members:manage": "members:manage";
+                "node-access:manage": "node-access:manage";
+                "audit:read": "audit:read";
+                "fleet:read": "fleet:read";
+            }>>;
+            scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"organization">;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"host">;
+                id: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"workspace">;
+                id: z.ZodString;
+            }, z.core.$strict>], "type">;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    signature: z.ZodString;
+}, z.core.$strict>], "v">;
+declare const CloudAuthorizationTrustedKeySchema: z.ZodObject<{
+    keyId: z.ZodString;
+    algorithm: z.ZodLiteral<"Ed25519">;
+    publicKey: z.ZodString;
+    notBefore: z.ZodOptional<z.ZodNumber>;
+    notAfter: z.ZodOptional<z.ZodNumber>;
+    trustExpiresAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+declare const CloudAuthorizationTrustedKeyV2Schema: z.ZodObject<{
+    keyId: z.ZodString;
+    algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+    publicKey: z.ZodString;
+    notBefore: z.ZodOptional<z.ZodNumber>;
+    notAfter: z.ZodOptional<z.ZodNumber>;
+    trustExpiresAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+declare const CloudAuthorizationTrustedKeyAnySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    keyId: z.ZodString;
+    algorithm: z.ZodLiteral<"Ed25519">;
+    publicKey: z.ZodString;
+    notBefore: z.ZodOptional<z.ZodNumber>;
+    notAfter: z.ZodOptional<z.ZodNumber>;
+    trustExpiresAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    keyId: z.ZodString;
+    algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+    publicKey: z.ZodString;
+    notBefore: z.ZodOptional<z.ZodNumber>;
+    notAfter: z.ZodOptional<z.ZodNumber>;
+    trustExpiresAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>], "algorithm">;
+type CloudAuthorizationPermission = z.infer<typeof CloudAuthorizationPermissionSchema>;
+type CloudRelayHostIdentity = z.infer<typeof CloudRelayHostIdentitySchema>;
+type CloudHostHeartbeatV1 = z.infer<typeof CloudHostHeartbeatV1Schema>;
+type CloudAuthorizationScopeV1 = z.infer<typeof CloudAuthorizationScopeV1Schema>;
+type CloudAuthorizationGrantV1 = z.infer<typeof CloudAuthorizationGrantV1Schema>;
+type CloudAuthorizationSnapshotV1 = z.infer<typeof CloudAuthorizationSnapshotV1Schema>;
+type CloudAuthorizationSnapshotV2 = z.infer<typeof CloudAuthorizationSnapshotV2Schema>;
+type CloudAuthorizationSnapshot = z.infer<typeof CloudAuthorizationSnapshotSchema>;
+type SignedCloudAuthorizationSnapshotV1 = z.infer<typeof SignedCloudAuthorizationSnapshotV1Schema>;
+type SignedCloudAuthorizationSnapshotV2 = z.infer<typeof SignedCloudAuthorizationSnapshotV2Schema>;
+type SignedCloudAuthorizationSnapshot = z.infer<typeof SignedCloudAuthorizationSnapshotSchema>;
+type CloudAuthorizationTrustedKeyV1 = z.infer<typeof CloudAuthorizationTrustedKeySchema>;
+type CloudAuthorizationTrustedKeyV2 = z.infer<typeof CloudAuthorizationTrustedKeyV2Schema>;
+type CloudAuthorizationTrustedKey = z.infer<typeof CloudAuthorizationTrustedKeyAnySchema>;
+type CloudAuthorizationVerificationErrorCode = "INVALID_ENVELOPE" | "INVALID_KEYRING" | "UNKNOWN_KEY" | "KEY_NOT_ACTIVE" | "TRUST_EXPIRED" | "ALGORITHM_MISMATCH" | "INVALID_PUBLIC_KEY" | "INVALID_SIGNATURE";
+declare class CloudAuthorizationVerificationError extends Error {
+    readonly code: CloudAuthorizationVerificationErrorCode;
+    constructor(code: CloudAuthorizationVerificationErrorCode, message: string);
+}
+declare function canonicalCloudJson(value: unknown): string;
+declare function parseCloudHostHeartbeat(value: unknown): CloudHostHeartbeatV1;
+declare function parseCloudAuthorizationSnapshot(value: unknown): CloudAuthorizationSnapshot;
+declare function parseSignedCloudAuthorizationSnapshot(value: unknown): SignedCloudAuthorizationSnapshot;
+/**
+ * Exact, domain-separated bytes that the cloud control plane signs and the host verifies.
+ *
+ * V1 signs the raw protected envelope for self-host compatibility. V2 signs exactly the SHA-256 digest of the
+ * protected envelope so hardware signers never receive attacker-amplifiable snapshot bytes.
+ */
+declare function cloudAuthorizationSnapshotSigningPayload(snapshot: unknown, keyId: string): Buffer;
+/** Verifies one envelope against any active key id, allowing safe overlap during signing-key rotation. */
+declare function verifySignedCloudAuthorizationSnapshot(value: unknown, trustedKeys: readonly CloudAuthorizationTrustedKey[], verificationTime?: number): SignedCloudAuthorizationSnapshot;
+
+declare const CLOUD_AUTHORIZATION_FILE = "cloud-authorization.json";
+declare const CLOUD_AUTHORIZATION_LAST_GOOD_FILE = "cloud-authorization.last-good.json";
+declare const CLOUD_AUTHORIZATION_CLOCK_SKEW_MS: number;
+type CloudAuthorizationSnapshotStatus = "unavailable" | "pending" | "active" | "expired";
+type CloudAuthorizationPrincipalType = "device" | "relay";
+type CloudAuthorizationStoreErrorCode = "TARGET_MISMATCH" | "CONTRACT_MISMATCH" | "REPLAY" | "TEMPORAL_REGRESSION" | "ISSUED_IN_FUTURE" | "ISSUED_TOO_OLD" | "NOT_YET_VALID" | "EXPIRED" | "PERSISTENCE_CORRUPT" | "PERSISTENCE_UNSAFE" | "REVISION_CONFLICT";
+declare class CloudAuthorizationStoreError extends Error {
+    readonly code: CloudAuthorizationStoreErrorCode;
+    constructor(code: CloudAuthorizationStoreErrorCode, message: string);
+}
+interface StoredCloudAuthorizationSnapshot {
+    acceptedAt: number;
+    envelope: SignedCloudAuthorizationSnapshot;
+    snapshot: CloudAuthorizationSnapshot;
+}
+interface CloudAuthorizationState {
+    status: CloudAuthorizationSnapshotStatus;
+    revision?: number;
+    notBefore?: number;
+    expiresAt?: number;
+}
+interface CloudAuthorizationDecision {
+    allowed: boolean;
+    reason: "cloud-grant" | "cloud-authorization-unavailable" | "cloud-authorization-pending" | "cloud-authorization-expired" | "cloud-principal-unbound" | "cloud-missing-permission" | "cloud-host-mismatch";
+    revision?: number;
+}
+interface OpenCloudAuthorizationStoreOptions {
+    dataDir: string;
+    organizationId: string;
+    hostId: string;
+    trustedKeys: readonly CloudAuthorizationTrustedKey[] | (() => readonly CloudAuthorizationTrustedKey[]);
+    /** Provisioned authorization contract. An envelope from another version is never accepted as a downgrade. */
+    authorizationVersion?: 1 | 2;
+    now?: () => number;
+    clockSkewMs?: number;
+}
+interface CloudAuthorizationStore {
+    readonly path: string;
+    readonly backupPath: string;
+    getLastKnownGood(): StoredCloudAuthorizationSnapshot | undefined;
+    getState(now?: number): CloudAuthorizationState;
+    getActiveSnapshot(now?: number): CloudAuthorizationSnapshot | undefined;
+    apply(value: unknown, now?: number): StoredCloudAuthorizationSnapshot;
+    reload(): StoredCloudAuthorizationSnapshot | undefined;
+    authorize(actorType: CloudAuthorizationPrincipalType, actorId: string, permission: CloudAuthorizationPermission, resource?: TeamAuthorizationResource, now?: number): CloudAuthorizationDecision;
+}
+declare function openCloudAuthorizationStore(options: OpenCloudAuthorizationStoreOptions): CloudAuthorizationStore;
+
+declare const DEFAULT_CLOUD_CONTROL_PLANE_URL = "https://roamcode.ai";
+declare const CLOUD_DEVICE_ENROLLMENT_CONFIRM_PATH = "/api/v1/hosts/device-enrollments/confirm";
+declare const CLOUD_DEVICE_ENROLLMENT_COMPLETE_PATH = "/api/v1/hosts/device-enrollments/complete";
+declare const CLOUD_DEVICE_ENROLLMENT_HOST_ROUTE = "/api/v1/cloud/device-enrollments/confirm";
+declare const CloudDeviceEnrollmentRequestSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    enrollmentId: z.ZodUUID;
+    challenge: z.ZodString;
+}, z.core.$strict>;
+declare const CloudHostDeviceEnrollmentConfirmationSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"host-device-enrollment-confirmation">;
+    enrollmentId: z.ZodUUID;
+    challenge: z.ZodString;
+    actorId: z.ZodString;
+    deviceIdentityPublicKey: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+declare const CloudHostDeviceEnrollmentCompletionSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"host-device-enrollment-completion">;
+    enrollmentId: z.ZodUUID;
+    actorId: z.ZodString;
+    temporaryRelayCredentialHash: z.ZodString;
+    durableRelayCredentialHash: z.ZodString;
+}, z.core.$strict>;
+declare const CloudRelayDeviceEnrollmentPayloadSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"cloud-device-enrollment">;
+    enrollmentId: z.ZodUUID;
+    challenge: z.ZodString;
+    name: z.ZodString;
+    localDeviceToken: z.ZodString;
+    durableRelayCredential: z.ZodString;
+}, z.core.$strict>;
+declare const CloudRelayDeviceEnrollmentAuthSchema: z.ZodObject<{
+    token: z.ZodString;
+    relayCredential: z.ZodString;
+    cloudEnrollment: z.ZodObject<{
+        v: z.ZodLiteral<1>;
+        kind: z.ZodLiteral<"cloud-device-enrollment">;
+        enrollmentId: z.ZodUUID;
+        challenge: z.ZodString;
+        name: z.ZodString;
+        localDeviceToken: z.ZodString;
+        durableRelayCredential: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+declare const CloudHostDeviceEnrollmentCompletionResponseSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    state: z.ZodEnum<{
+        revoked: "revoked";
+        active: "active";
+    }>;
+    deviceId: z.ZodUUID;
+}, z.core.$strict>;
+type CloudDeviceEnrollmentRequest = z.infer<typeof CloudDeviceEnrollmentRequestSchema>;
+type CloudHostDeviceEnrollmentConfirmation = z.infer<typeof CloudHostDeviceEnrollmentConfirmationSchema>;
+type CloudHostDeviceEnrollmentCompletion = z.infer<typeof CloudHostDeviceEnrollmentCompletionSchema>;
+type CloudHostDeviceEnrollmentCompletionResult = z.infer<typeof CloudHostDeviceEnrollmentCompletionResponseSchema>;
+type CloudRelayDeviceEnrollmentPayload = z.infer<typeof CloudRelayDeviceEnrollmentPayloadSchema>;
+type CloudRelayDeviceEnrollmentAuth = z.infer<typeof CloudRelayDeviceEnrollmentAuthSchema>;
+interface CloudDeviceEnrollmentConfirmationResult {
+    actorId: string;
+    deviceId: string;
+    temporaryRelayCredentialHash?: string;
+    deviceIdentity?: {
+        publicKey: string;
+        fingerprint: string;
+    };
+}
+interface CloudRelayDeviceEnrollmentSaga {
+    enroll(input: {
+        actorId: string;
+        deviceIdentityPublicKey: string;
+        cloudEnrollment: unknown;
+    }): Promise<{
+        device: DeviceInfo;
+        token: string;
+    }>;
+    recover(): Promise<{
+        completed: number;
+        failed: number;
+    }>;
+}
+interface CloudDeviceEnrollmentConfirmer {
+    confirm(input: CloudHostDeviceEnrollmentConfirmation): Promise<CloudDeviceEnrollmentConfirmationResult>;
+    complete(input: CloudHostDeviceEnrollmentCompletion): Promise<CloudHostDeviceEnrollmentCompletionResult>;
+}
+interface CloudDeviceEnrollmentRuntimeConfig {
+    controlPlaneOrigin: string;
+    hostCredential: string;
+}
+type CloudDeviceEnrollmentErrorCode = "REJECTED" | "UNAVAILABLE" | "INVALID_RESPONSE";
+declare class CloudDeviceEnrollmentError extends Error {
+    readonly code: CloudDeviceEnrollmentErrorCode;
+    readonly retryable: boolean;
+    constructor(code: CloudDeviceEnrollmentErrorCode, retryable: boolean);
+}
+interface CreateCloudDeviceEnrollmentConfirmerOptions extends CloudDeviceEnrollmentRuntimeConfig {
+    fetch?: typeof globalThis.fetch;
+    timeoutMs?: number;
+}
+/** Normalize an origin once so a client payload can never choose where the host credential is sent. */
+declare function normalizeCloudControlPlaneOrigin(value: string): string;
+/** Read a host capability without following links or accepting permissions that expose it to other users. */
+declare function readCloudHostCredentialFile(path: string): string;
+/** URL-only configuration is harmless; cloud host enrollment is enabled only when its credential file is set. */
+declare function resolveCloudDeviceEnrollmentConfig(env: NodeJS.ProcessEnv): CloudDeviceEnrollmentRuntimeConfig | undefined;
+declare function createCloudDeviceEnrollmentConfirmer(options: CreateCloudDeviceEnrollmentConfirmerOptions): CloudDeviceEnrollmentConfirmer;
+interface CreateCloudRelayDeviceEnrollmentSagaOptions {
+    devices: DeviceStore;
+    confirmer: CloudDeviceEnrollmentConfirmer;
+    provisioner: RelayDeviceProvisioner;
+    refreshAuthorization?: () => Promise<unknown>;
+    /** Managed Nodes must observe the newly confirmed relay actor in a fresh signed snapshot before activation. */
+    authorizationReady?: (actorId: string) => boolean;
+    now?: () => number;
+}
+/** The control plane has one canonical identity namespace for both direct and relay-connected browsers. */
+declare function cloudDeviceEnrollmentAuthorizationReady(authorizationStore: Pick<CloudAuthorizationStore, "getActiveSnapshot">, actorId: string): boolean;
+/**
+ * Commits a browser enrollment in three durable phases. The control plane sees only the signed device public key;
+ * local and relay bearer credentials stay inside the encrypted browser-to-Node channel and are persisted as hashes.
+ */
+declare function createCloudRelayDeviceEnrollmentSaga(options: CreateCloudRelayDeviceEnrollmentSagaOptions): CloudRelayDeviceEnrollmentSaga;
+interface CloudDeviceEnrollmentRecoveryLoop {
+    start(): void;
+    stop(): Promise<void>;
+}
+interface CreateCloudDeviceEnrollmentRecoveryLoopOptions {
+    saga: Pick<CloudRelayDeviceEnrollmentSaga, "recover">;
+    intervalMs?: number;
+    onResult?: (result: {
+        completed: number;
+        failed: number;
+    }) => void;
+}
+/**
+ * Starts one recovery attempt immediately and retries on a fixed cadence without ever overlapping attempts.
+ * The saga itself caps each pass and every network client it calls has a request timeout.
+ */
+declare function createCloudDeviceEnrollmentRecoveryLoop(options: CreateCloudDeviceEnrollmentRecoveryLoopOptions): CloudDeviceEnrollmentRecoveryLoop;
+
 type RelayHostStatus = "idle" | "connecting" | "online" | "reconnecting" | "stopped";
 interface RelayHostMetrics {
     status: RelayHostStatus;
@@ -1411,6 +2210,8 @@ interface RelayHostConnectorOptions {
     onStatus?: (status: RelayHostStatus) => void;
     /** Promotes a five-minute broker bootstrap credential after the E2E pairing claim commits. */
     promoteDevice?: (deviceId: string, credentialHash: string) => Promise<void>;
+    /** Account-driven browser enrollment over the already encrypted relay auth channel. */
+    cloudDeviceEnrollment?: CloudRelayDeviceEnrollmentSaga;
 }
 interface RelayTerminalOpenRequest {
     streamId: string;
@@ -1485,6 +2286,681 @@ declare function writeRelayHostConfig(dataDir: string, input: RelayHostConfigInp
 declare function removeRelayHostConfig(dataDir: string): boolean;
 declare function resolveRelayHostConfig(env: NodeJS.ProcessEnv, dataDir: string): RelayHostRuntimeConfig | undefined;
 
+declare const CLOUD_AUTHORIZATION_KEYSET_SIGNATURE_DOMAIN = "roamcode-cloud-authorization-keyset-v1";
+declare const CLOUD_AUTHORIZATION_KEYSET_SIGNATURE_DOMAIN_V2 = "roamcode-cloud-authorization-keyset-v2";
+declare const CLOUD_AUTHORIZATION_KEYSET_PATH = "/api/v1/meta/authorization-keyset";
+declare const CLOUD_KEYSET_CLOCK_SKEW_MS: number;
+declare const CloudAuthorizationKeysetKeyV1Schema: z.ZodObject<{
+    keyId: z.ZodString;
+    algorithm: z.ZodLiteral<"Ed25519">;
+    publicKey: z.ZodString;
+    notBefore: z.ZodNumber;
+    notAfter: z.ZodNullable<z.ZodNumber>;
+    status: z.ZodEnum<{
+        current: "current";
+        previous: "previous";
+    }>;
+}, z.core.$strict>;
+declare const CloudAuthorizationKeysetKeyV2Schema: z.ZodObject<{
+    keyId: z.ZodString;
+    algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+    publicKey: z.ZodString;
+    notBefore: z.ZodNumber;
+    notAfter: z.ZodNullable<z.ZodNumber>;
+    status: z.ZodEnum<{
+        current: "current";
+        previous: "previous";
+    }>;
+}, z.core.$strict>;
+declare const CloudAuthorizationKeysetV1Schema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"authorization-keyset">;
+    issuedAt: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+    keys: z.ZodArray<z.ZodObject<{
+        keyId: z.ZodString;
+        algorithm: z.ZodLiteral<"Ed25519">;
+        publicKey: z.ZodString;
+        notBefore: z.ZodNumber;
+        notAfter: z.ZodNullable<z.ZodNumber>;
+        status: z.ZodEnum<{
+            current: "current";
+            previous: "previous";
+        }>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+declare const CloudAuthorizationKeysetV2Schema: z.ZodObject<{
+    v: z.ZodLiteral<2>;
+    kind: z.ZodLiteral<"authorization-keyset">;
+    issuedAt: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+    keys: z.ZodArray<z.ZodObject<{
+        keyId: z.ZodString;
+        algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+        publicKey: z.ZodString;
+        notBefore: z.ZodNumber;
+        notAfter: z.ZodNullable<z.ZodNumber>;
+        status: z.ZodEnum<{
+            current: "current";
+            previous: "previous";
+        }>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+declare const CloudAuthorizationKeysetSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"authorization-keyset">;
+    issuedAt: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+    keys: z.ZodArray<z.ZodObject<{
+        keyId: z.ZodString;
+        algorithm: z.ZodLiteral<"Ed25519">;
+        publicKey: z.ZodString;
+        notBefore: z.ZodNumber;
+        notAfter: z.ZodNullable<z.ZodNumber>;
+        status: z.ZodEnum<{
+            current: "current";
+            previous: "previous";
+        }>;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    v: z.ZodLiteral<2>;
+    kind: z.ZodLiteral<"authorization-keyset">;
+    issuedAt: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+    keys: z.ZodArray<z.ZodObject<{
+        keyId: z.ZodString;
+        algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+        publicKey: z.ZodString;
+        notBefore: z.ZodNumber;
+        notAfter: z.ZodNullable<z.ZodNumber>;
+        status: z.ZodEnum<{
+            current: "current";
+            previous: "previous";
+        }>;
+    }, z.core.$strict>>;
+}, z.core.$strict>], "v">;
+declare const SignedCloudAuthorizationKeysetSignatureV1Schema: z.ZodObject<{
+    keyId: z.ZodString;
+    algorithm: z.ZodLiteral<"Ed25519">;
+    signature: z.ZodString;
+}, z.core.$strict>;
+declare const SignedCloudAuthorizationKeysetSignatureV2Schema: z.ZodObject<{
+    keyId: z.ZodString;
+    algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+    signature: z.ZodString;
+}, z.core.$strict>;
+declare const SignedCloudAuthorizationKeysetV1Schema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"signed-authorization-keyset">;
+    keyset: z.ZodObject<{
+        v: z.ZodLiteral<1>;
+        kind: z.ZodLiteral<"authorization-keyset">;
+        issuedAt: z.ZodNumber;
+        expiresAt: z.ZodNumber;
+        keys: z.ZodArray<z.ZodObject<{
+            keyId: z.ZodString;
+            algorithm: z.ZodLiteral<"Ed25519">;
+            publicKey: z.ZodString;
+            notBefore: z.ZodNumber;
+            notAfter: z.ZodNullable<z.ZodNumber>;
+            status: z.ZodEnum<{
+                current: "current";
+                previous: "previous";
+            }>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    signatures: z.ZodArray<z.ZodObject<{
+        keyId: z.ZodString;
+        algorithm: z.ZodLiteral<"Ed25519">;
+        signature: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+declare const SignedCloudAuthorizationKeysetV2Schema: z.ZodObject<{
+    v: z.ZodLiteral<2>;
+    kind: z.ZodLiteral<"signed-authorization-keyset">;
+    keyset: z.ZodObject<{
+        v: z.ZodLiteral<2>;
+        kind: z.ZodLiteral<"authorization-keyset">;
+        issuedAt: z.ZodNumber;
+        expiresAt: z.ZodNumber;
+        keys: z.ZodArray<z.ZodObject<{
+            keyId: z.ZodString;
+            algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+            publicKey: z.ZodString;
+            notBefore: z.ZodNumber;
+            notAfter: z.ZodNullable<z.ZodNumber>;
+            status: z.ZodEnum<{
+                current: "current";
+                previous: "previous";
+            }>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    signatures: z.ZodArray<z.ZodObject<{
+        keyId: z.ZodString;
+        algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+        signature: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+declare const SignedCloudAuthorizationKeysetSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"signed-authorization-keyset">;
+    keyset: z.ZodObject<{
+        v: z.ZodLiteral<1>;
+        kind: z.ZodLiteral<"authorization-keyset">;
+        issuedAt: z.ZodNumber;
+        expiresAt: z.ZodNumber;
+        keys: z.ZodArray<z.ZodObject<{
+            keyId: z.ZodString;
+            algorithm: z.ZodLiteral<"Ed25519">;
+            publicKey: z.ZodString;
+            notBefore: z.ZodNumber;
+            notAfter: z.ZodNullable<z.ZodNumber>;
+            status: z.ZodEnum<{
+                current: "current";
+                previous: "previous";
+            }>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    signatures: z.ZodArray<z.ZodObject<{
+        keyId: z.ZodString;
+        algorithm: z.ZodLiteral<"Ed25519">;
+        signature: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    v: z.ZodLiteral<2>;
+    kind: z.ZodLiteral<"signed-authorization-keyset">;
+    keyset: z.ZodObject<{
+        v: z.ZodLiteral<2>;
+        kind: z.ZodLiteral<"authorization-keyset">;
+        issuedAt: z.ZodNumber;
+        expiresAt: z.ZodNumber;
+        keys: z.ZodArray<z.ZodObject<{
+            keyId: z.ZodString;
+            algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+            publicKey: z.ZodString;
+            notBefore: z.ZodNumber;
+            notAfter: z.ZodNullable<z.ZodNumber>;
+            status: z.ZodEnum<{
+                current: "current";
+                previous: "previous";
+            }>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    signatures: z.ZodArray<z.ZodObject<{
+        keyId: z.ZodString;
+        algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+        signature: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>], "v">;
+type CloudAuthorizationKeysetKeyV1 = z.infer<typeof CloudAuthorizationKeysetKeyV1Schema>;
+type CloudAuthorizationKeysetKeyV2 = z.infer<typeof CloudAuthorizationKeysetKeyV2Schema>;
+type CloudAuthorizationKeysetKey = CloudAuthorizationKeysetKeyV1 | CloudAuthorizationKeysetKeyV2;
+type CloudAuthorizationKeysetV1 = z.infer<typeof CloudAuthorizationKeysetV1Schema>;
+type CloudAuthorizationKeysetV2 = z.infer<typeof CloudAuthorizationKeysetV2Schema>;
+type CloudAuthorizationKeyset = z.infer<typeof CloudAuthorizationKeysetSchema>;
+type SignedCloudAuthorizationKeysetV1 = z.infer<typeof SignedCloudAuthorizationKeysetV1Schema>;
+type SignedCloudAuthorizationKeysetV2 = z.infer<typeof SignedCloudAuthorizationKeysetV2Schema>;
+type SignedCloudAuthorizationKeyset = z.infer<typeof SignedCloudAuthorizationKeysetSchema>;
+type CloudKeysetVerificationErrorCode = "INVALID_KEYSET" | "INVALID_PINNED_KEY" | "ISSUED_IN_FUTURE" | "EXPIRED" | "PIN_EXPIRED" | "UNTRUSTED_ROTATION" | "KEYSET_ROLLBACK";
+declare class CloudKeysetVerificationError extends Error {
+    readonly code: CloudKeysetVerificationErrorCode;
+    constructor(code: CloudKeysetVerificationErrorCode);
+}
+declare function parseCloudAuthorizationKeyset(value: unknown): CloudAuthorizationKeyset;
+declare function cloudAuthorizationKeysetSigningPayload(keyset: unknown): Buffer;
+declare function cloudAuthorizationTrustedKeysFromKeyset(value: unknown): readonly CloudAuthorizationTrustedKey[];
+declare function verifySignedCloudAuthorizationKeyset(value: unknown, pinnedKeysetValue: unknown, now?: number, clockSkewMs?: number): SignedCloudAuthorizationKeyset;
+
+declare const CLOUD_HOST_CONFIG_FILE = "cloud-host.json";
+declare const CloudHostConfigV1Schema: z.ZodPipe<z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"roamcode-cloud-host-config">;
+    organizationId: z.ZodUUID;
+    hostId: z.ZodUUID;
+    controlPlaneOrigin: z.ZodString;
+    hostCredential: z.ZodString;
+    authorization: z.ZodObject<{
+        algorithm: z.ZodLiteral<"Ed25519">;
+        signatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-snapshot-v1">;
+        keysetSignatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-keyset-v1">;
+        keyset: z.ZodObject<{
+            v: z.ZodLiteral<1>;
+            kind: z.ZodLiteral<"authorization-keyset">;
+            issuedAt: z.ZodNumber;
+            expiresAt: z.ZodNumber;
+            keys: z.ZodArray<z.ZodObject<{
+                keyId: z.ZodString;
+                algorithm: z.ZodLiteral<"Ed25519">;
+                publicKey: z.ZodString;
+                notBefore: z.ZodNumber;
+                notAfter: z.ZodNullable<z.ZodNumber>;
+                status: z.ZodEnum<{
+                    current: "current";
+                    previous: "previous";
+                }>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    heartbeatIntervalSeconds: z.ZodNumber;
+    authorizationRefreshIntervalSeconds: z.ZodNumber;
+}, z.core.$strict>, z.ZodTransform<{
+    controlPlaneOrigin: string;
+    v: 1;
+    kind: "roamcode-cloud-host-config";
+    organizationId: string;
+    hostId: string;
+    hostCredential: string;
+    authorization: {
+        algorithm: "Ed25519";
+        signatureDomain: "roamcode-cloud-authorization-snapshot-v1";
+        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v1";
+        keyset: {
+            v: 1;
+            kind: "authorization-keyset";
+            issuedAt: number;
+            expiresAt: number;
+            keys: {
+                keyId: string;
+                algorithm: "Ed25519";
+                publicKey: string;
+                notBefore: number;
+                notAfter: number | null;
+                status: "current" | "previous";
+            }[];
+        };
+    };
+    heartbeatIntervalSeconds: number;
+    authorizationRefreshIntervalSeconds: number;
+}, {
+    v: 1;
+    kind: "roamcode-cloud-host-config";
+    organizationId: string;
+    hostId: string;
+    controlPlaneOrigin: string;
+    hostCredential: string;
+    authorization: {
+        algorithm: "Ed25519";
+        signatureDomain: "roamcode-cloud-authorization-snapshot-v1";
+        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v1";
+        keyset: {
+            v: 1;
+            kind: "authorization-keyset";
+            issuedAt: number;
+            expiresAt: number;
+            keys: {
+                keyId: string;
+                algorithm: "Ed25519";
+                publicKey: string;
+                notBefore: number;
+                notAfter: number | null;
+                status: "current" | "previous";
+            }[];
+        };
+    };
+    heartbeatIntervalSeconds: number;
+    authorizationRefreshIntervalSeconds: number;
+}>>;
+declare const CloudHostConfigV2Schema: z.ZodPipe<z.ZodObject<{
+    v: z.ZodLiteral<2>;
+    kind: z.ZodLiteral<"roamcode-cloud-host-config">;
+    organizationId: z.ZodUUID;
+    hostId: z.ZodUUID;
+    controlPlaneOrigin: z.ZodString;
+    hostCredential: z.ZodString;
+    authorization: z.ZodObject<{
+        algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+        signatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-snapshot-v2">;
+        keysetSignatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-keyset-v2">;
+        keyset: z.ZodObject<{
+            v: z.ZodLiteral<2>;
+            kind: z.ZodLiteral<"authorization-keyset">;
+            issuedAt: z.ZodNumber;
+            expiresAt: z.ZodNumber;
+            keys: z.ZodArray<z.ZodObject<{
+                keyId: z.ZodString;
+                algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+                publicKey: z.ZodString;
+                notBefore: z.ZodNumber;
+                notAfter: z.ZodNullable<z.ZodNumber>;
+                status: z.ZodEnum<{
+                    current: "current";
+                    previous: "previous";
+                }>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    heartbeatIntervalSeconds: z.ZodNumber;
+    authorizationRefreshIntervalSeconds: z.ZodNumber;
+}, z.core.$strict>, z.ZodTransform<{
+    controlPlaneOrigin: string;
+    v: 2;
+    kind: "roamcode-cloud-host-config";
+    organizationId: string;
+    hostId: string;
+    hostCredential: string;
+    authorization: {
+        algorithm: "Ed25519-SHA256";
+        signatureDomain: "roamcode-cloud-authorization-snapshot-v2";
+        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v2";
+        keyset: {
+            v: 2;
+            kind: "authorization-keyset";
+            issuedAt: number;
+            expiresAt: number;
+            keys: {
+                keyId: string;
+                algorithm: "Ed25519-SHA256";
+                publicKey: string;
+                notBefore: number;
+                notAfter: number | null;
+                status: "current" | "previous";
+            }[];
+        };
+    };
+    heartbeatIntervalSeconds: number;
+    authorizationRefreshIntervalSeconds: number;
+}, {
+    v: 2;
+    kind: "roamcode-cloud-host-config";
+    organizationId: string;
+    hostId: string;
+    controlPlaneOrigin: string;
+    hostCredential: string;
+    authorization: {
+        algorithm: "Ed25519-SHA256";
+        signatureDomain: "roamcode-cloud-authorization-snapshot-v2";
+        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v2";
+        keyset: {
+            v: 2;
+            kind: "authorization-keyset";
+            issuedAt: number;
+            expiresAt: number;
+            keys: {
+                keyId: string;
+                algorithm: "Ed25519-SHA256";
+                publicKey: string;
+                notBefore: number;
+                notAfter: number | null;
+                status: "current" | "previous";
+            }[];
+        };
+    };
+    heartbeatIntervalSeconds: number;
+    authorizationRefreshIntervalSeconds: number;
+}>>;
+declare const CloudHostConfigSchema: z.ZodUnion<readonly [z.ZodPipe<z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"roamcode-cloud-host-config">;
+    organizationId: z.ZodUUID;
+    hostId: z.ZodUUID;
+    controlPlaneOrigin: z.ZodString;
+    hostCredential: z.ZodString;
+    authorization: z.ZodObject<{
+        algorithm: z.ZodLiteral<"Ed25519">;
+        signatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-snapshot-v1">;
+        keysetSignatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-keyset-v1">;
+        keyset: z.ZodObject<{
+            v: z.ZodLiteral<1>;
+            kind: z.ZodLiteral<"authorization-keyset">;
+            issuedAt: z.ZodNumber;
+            expiresAt: z.ZodNumber;
+            keys: z.ZodArray<z.ZodObject<{
+                keyId: z.ZodString;
+                algorithm: z.ZodLiteral<"Ed25519">;
+                publicKey: z.ZodString;
+                notBefore: z.ZodNumber;
+                notAfter: z.ZodNullable<z.ZodNumber>;
+                status: z.ZodEnum<{
+                    current: "current";
+                    previous: "previous";
+                }>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    heartbeatIntervalSeconds: z.ZodNumber;
+    authorizationRefreshIntervalSeconds: z.ZodNumber;
+}, z.core.$strict>, z.ZodTransform<{
+    controlPlaneOrigin: string;
+    v: 1;
+    kind: "roamcode-cloud-host-config";
+    organizationId: string;
+    hostId: string;
+    hostCredential: string;
+    authorization: {
+        algorithm: "Ed25519";
+        signatureDomain: "roamcode-cloud-authorization-snapshot-v1";
+        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v1";
+        keyset: {
+            v: 1;
+            kind: "authorization-keyset";
+            issuedAt: number;
+            expiresAt: number;
+            keys: {
+                keyId: string;
+                algorithm: "Ed25519";
+                publicKey: string;
+                notBefore: number;
+                notAfter: number | null;
+                status: "current" | "previous";
+            }[];
+        };
+    };
+    heartbeatIntervalSeconds: number;
+    authorizationRefreshIntervalSeconds: number;
+}, {
+    v: 1;
+    kind: "roamcode-cloud-host-config";
+    organizationId: string;
+    hostId: string;
+    controlPlaneOrigin: string;
+    hostCredential: string;
+    authorization: {
+        algorithm: "Ed25519";
+        signatureDomain: "roamcode-cloud-authorization-snapshot-v1";
+        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v1";
+        keyset: {
+            v: 1;
+            kind: "authorization-keyset";
+            issuedAt: number;
+            expiresAt: number;
+            keys: {
+                keyId: string;
+                algorithm: "Ed25519";
+                publicKey: string;
+                notBefore: number;
+                notAfter: number | null;
+                status: "current" | "previous";
+            }[];
+        };
+    };
+    heartbeatIntervalSeconds: number;
+    authorizationRefreshIntervalSeconds: number;
+}>>, z.ZodPipe<z.ZodObject<{
+    v: z.ZodLiteral<2>;
+    kind: z.ZodLiteral<"roamcode-cloud-host-config">;
+    organizationId: z.ZodUUID;
+    hostId: z.ZodUUID;
+    controlPlaneOrigin: z.ZodString;
+    hostCredential: z.ZodString;
+    authorization: z.ZodObject<{
+        algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+        signatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-snapshot-v2">;
+        keysetSignatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-keyset-v2">;
+        keyset: z.ZodObject<{
+            v: z.ZodLiteral<2>;
+            kind: z.ZodLiteral<"authorization-keyset">;
+            issuedAt: z.ZodNumber;
+            expiresAt: z.ZodNumber;
+            keys: z.ZodArray<z.ZodObject<{
+                keyId: z.ZodString;
+                algorithm: z.ZodLiteral<"Ed25519-SHA256">;
+                publicKey: z.ZodString;
+                notBefore: z.ZodNumber;
+                notAfter: z.ZodNullable<z.ZodNumber>;
+                status: z.ZodEnum<{
+                    current: "current";
+                    previous: "previous";
+                }>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    heartbeatIntervalSeconds: z.ZodNumber;
+    authorizationRefreshIntervalSeconds: z.ZodNumber;
+}, z.core.$strict>, z.ZodTransform<{
+    controlPlaneOrigin: string;
+    v: 2;
+    kind: "roamcode-cloud-host-config";
+    organizationId: string;
+    hostId: string;
+    hostCredential: string;
+    authorization: {
+        algorithm: "Ed25519-SHA256";
+        signatureDomain: "roamcode-cloud-authorization-snapshot-v2";
+        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v2";
+        keyset: {
+            v: 2;
+            kind: "authorization-keyset";
+            issuedAt: number;
+            expiresAt: number;
+            keys: {
+                keyId: string;
+                algorithm: "Ed25519-SHA256";
+                publicKey: string;
+                notBefore: number;
+                notAfter: number | null;
+                status: "current" | "previous";
+            }[];
+        };
+    };
+    heartbeatIntervalSeconds: number;
+    authorizationRefreshIntervalSeconds: number;
+}, {
+    v: 2;
+    kind: "roamcode-cloud-host-config";
+    organizationId: string;
+    hostId: string;
+    controlPlaneOrigin: string;
+    hostCredential: string;
+    authorization: {
+        algorithm: "Ed25519-SHA256";
+        signatureDomain: "roamcode-cloud-authorization-snapshot-v2";
+        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v2";
+        keyset: {
+            v: 2;
+            kind: "authorization-keyset";
+            issuedAt: number;
+            expiresAt: number;
+            keys: {
+                keyId: string;
+                algorithm: "Ed25519-SHA256";
+                publicKey: string;
+                notBefore: number;
+                notAfter: number | null;
+                status: "current" | "previous";
+            }[];
+        };
+    };
+    heartbeatIntervalSeconds: number;
+    authorizationRefreshIntervalSeconds: number;
+}>>]>;
+type CloudHostConfigV1 = z.output<typeof CloudHostConfigV1Schema>;
+type CloudHostConfigV2 = z.output<typeof CloudHostConfigV2Schema>;
+type CloudHostConfig = z.output<typeof CloudHostConfigSchema>;
+interface ResolvedCloudHostConfig {
+    path: string;
+    config: CloudHostConfig;
+}
+declare function cloudHostConfigPath(dataDir: string): string;
+declare function readCloudHostConfig(path: string): CloudHostConfig | undefined;
+declare function writeCloudHostConfig(path: string, value: unknown): CloudHostConfig;
+/** Remove a managed host configuration without following links or deleting an unowned file. */
+declare function removeCloudHostConfig(path: string): boolean;
+declare function replaceCloudHostAuthorizationKeyset(path: string, current: CloudHostConfig, keyset: CloudAuthorizationKeyset): CloudHostConfig;
+declare function resolveCloudHostConfig(env: NodeJS.ProcessEnv, dataDir: string): ResolvedCloudHostConfig | undefined;
+
+declare const CLOUD_HOST_HEARTBEAT_PATH = "/api/v1/hosts/heartbeat";
+declare const CLOUD_HOST_AUTHORIZATION_SNAPSHOT_PATH = "/api/v1/hosts/authorization-snapshot";
+declare const CLOUD_HOST_MAX_SIGNED_RESPONSE_BYTES: number;
+interface CloudHostRuntimeStatus {
+    running: boolean;
+    heartbeatFailures: number;
+    authorizationFailures: number;
+    authorizationIssue?: CloudHostAuthorizationIssue;
+    lastHeartbeatAt?: number;
+    lastAuthorizationAt?: number;
+    authorization: CloudAuthorizationState;
+}
+type CloudHostAuthorizationIssue = "connectivity" | "credential-rejected" | "invalid-control-plane-response" | "authorization-verification-failed" | "trust-expired";
+interface CloudHostRuntime {
+    start(): void;
+    stop(): Promise<void>;
+    sendHeartbeat(state?: "ready" | "draining"): Promise<void>;
+    refreshAuthorizationKeyset(): Promise<boolean>;
+    refreshAuthorizationSnapshot(): Promise<number>;
+    syncAuthorization(): Promise<number>;
+    /** Waits out an older in-flight poll, then starts a snapshot request from the resulting durable revision. */
+    syncAuthorizationFresh(): Promise<number>;
+    status(): CloudHostRuntimeStatus;
+}
+interface CreateCloudHostRuntimeOptions {
+    config: CloudHostConfig;
+    authorizationStore: CloudAuthorizationStore;
+    instanceId: string;
+    softwareVersion: string;
+    capabilities: readonly string[] | (() => readonly string[]);
+    /** Stable P-256 host identity advertised for browser enrollment pinning; private key never leaves this Node. */
+    relayHostIdentity?: CloudRelayHostIdentity;
+    /** Called only after a signed rotation verifies against the currently pinned keyset. Must persist atomically. */
+    replaceAuthorizationKeyset: (keyset: CloudAuthorizationKeyset) => void;
+    fetch?: typeof globalThis.fetch;
+    now?: () => number;
+    random?: () => number;
+    requestTimeoutMs?: number;
+    setTimeout?: typeof globalThis.setTimeout;
+    clearTimeout?: typeof globalThis.clearTimeout;
+}
+type CloudHostRuntimeErrorCode = "UNAVAILABLE" | "REJECTED" | "INVALID_RESPONSE" | "KEYSET_REPLAY";
+declare class CloudHostRuntimeError extends Error {
+    readonly code: CloudHostRuntimeErrorCode;
+    readonly retryable: boolean;
+    constructor(code: CloudHostRuntimeErrorCode, retryable: boolean);
+}
+declare function createCloudHostRuntime(options: CreateCloudHostRuntimeOptions): CloudHostRuntime;
+
+type CompositeAuthorizationReason = TeamAuthorizationDecision["reason"] | CloudAuthorizationDecision["reason"];
+interface CompositeAuthorizationDecision {
+    allowed: boolean;
+    reason: CompositeAuthorizationReason;
+    source: "local" | "team" | "cloud";
+    roles: TeamRole[];
+    member?: TeamMember;
+    cloudRevision?: number;
+}
+interface CompositeAuthorizer {
+    authorize(actorType: TeamPrincipalType, actorId: string, permission: TeamPermission, resource?: TeamAuthorizationResource): CompositeAuthorizationDecision;
+}
+interface CreateCompositeAuthorizerOptions {
+    teamStore: TeamStore;
+    /** Omit for self-hosted mode; presence makes a valid cloud grant an additional requirement for remote actors. */
+    cloudStore?: CloudAuthorizationStore;
+    /**
+     * The managed control plane may assign the same physical Node a cloud Host id that differs from the
+     * command-center store's local Host id. TeamStore must continue authorizing against the local id while the
+     * signed cloud snapshot must see its own target id, so translate only the cloud layer at this composition
+     * boundary instead of leaking a connection alias into every local resource.
+     */
+    cloudHostId?: string;
+    /** Persisted managed ownership without a usable cloud store remains fail-closed for every remote actor. */
+    requireCloud?: boolean;
+    now?: () => number;
+}
+/**
+ * Composes cloud grants with the existing local TeamStore policy. Self-hosted callers keep TeamStore behavior
+ * exactly; cloud-managed callers must pass both layers. Host and local recovery principals never depend on cloud
+ * availability, so an expired or unreachable control plane cannot lock an operator out of their own machine.
+ */
+declare function createCompositeAuthorizer(options: CreateCompositeAuthorizerOptions): CompositeAuthorizer;
+
 interface LoopbackRelayTerminalOptions {
     baseUrl(): string | undefined;
     issueTicket(token: string): Promise<string>;
@@ -2198,6 +3674,224 @@ declare function privacySafeAuditMetadata(value: Record<string, unknown> | undef
 declare function openControlStore(opts: OpenControlStoreOptions): ControlStore;
 declare const CONTROL_IDEMPOTENCY_TTL_MS: number;
 
+type SessionAutomationStoreMode = "sqlite" | "memory-fallback";
+type AutomationOwnerType = "person" | "organization";
+type SessionAutomationTrigger = {
+    type: "manual";
+};
+type SessionAutomationRunStatus = "starting" | "running" | "needs-input" | "ready" | "failed" | "cancelled";
+type SessionAutomationBootstrapState = "pending" | "submitting" | "submitted";
+type SessionAutomationBootstrapClaim = "claimed" | "already-started" | "missing";
+interface SessionAutomationDefinition {
+    id: string;
+    owner: {
+        type: AutomationOwnerType;
+        id: string;
+    };
+    name: string;
+    enabled: boolean;
+    nodeId: string;
+    agentRuntimeId: string;
+    provider: string;
+    cwd: string;
+    instruction: string;
+    runtimeOptions: Record<string, unknown>;
+    trigger: SessionAutomationTrigger;
+    revision: number;
+    createdAt: number;
+    updatedAt: number;
+}
+interface SessionAutomationRun {
+    id: string;
+    automationId: string;
+    definitionRevision: number;
+    invocationId: string;
+    sessionId: string;
+    nodeId: string;
+    agentRuntimeId: string;
+    cwd: string;
+    status: SessionAutomationRunStatus;
+    failureCode?: string;
+    createdAt: number;
+    updatedAt: number;
+}
+/**
+ * Private, immutable launch input captured with a Run. It is intentionally separate from SessionAutomationRun so
+ * ordinary API projections cannot accidentally disclose instructions or provider launch options.
+ */
+interface SessionAutomationRunInputSnapshot {
+    runId: string;
+    automationId: string;
+    definitionRevision: number;
+    provider: string;
+    instruction: string;
+    runtimeOptions: Record<string, unknown>;
+    bootstrapState: SessionAutomationBootstrapState;
+}
+interface CreateSessionAutomationRunInput {
+    automationId: string;
+    definitionRevision: number;
+    invocationId: string;
+    sessionId: string;
+    nodeId: string;
+    agentRuntimeId: string;
+    cwd: string;
+    /** Explicit values preserve the exact revision selected by a caller racing a later definition update. */
+    provider?: string;
+    instruction?: string;
+    runtimeOptions?: Record<string, unknown>;
+}
+interface CreateSessionAutomationInput {
+    owner: {
+        type: AutomationOwnerType;
+        id: string;
+    };
+    name: string;
+    enabled?: boolean;
+    nodeId: string;
+    agentRuntimeId: string;
+    provider: string;
+    cwd: string;
+    instruction: string;
+    runtimeOptions?: Record<string, unknown>;
+    trigger?: SessionAutomationTrigger;
+}
+interface UpdateSessionAutomationInput {
+    name?: string;
+    enabled?: boolean;
+    nodeId?: string;
+    agentRuntimeId?: string;
+    provider?: string;
+    cwd?: string;
+    instruction?: string;
+    runtimeOptions?: Record<string, unknown>;
+    trigger?: SessionAutomationTrigger;
+}
+interface SessionAutomationStore {
+    readonly mode: SessionAutomationStoreMode;
+    getNodeOwner(nodeId: string): {
+        type: AutomationOwnerType;
+        id: string;
+    } | undefined;
+    list(owner?: {
+        type: AutomationOwnerType;
+        id: string;
+    }): SessionAutomationDefinition[];
+    get(id: string): SessionAutomationDefinition | undefined;
+    getIncludingRemoved(id: string): SessionAutomationDefinition | undefined;
+    create(input: CreateSessionAutomationInput, now?: number): SessionAutomationDefinition;
+    update(id: string, input: UpdateSessionAutomationInput, expectedRevision: number, now?: number): SessionAutomationDefinition | undefined;
+    transferOwner(from: {
+        type: AutomationOwnerType;
+        id: string;
+    }, to: {
+        type: AutomationOwnerType;
+        id: string;
+    }, nodeId: string, now?: number): number;
+    remove(id: string): boolean;
+    getRun(id: string): SessionAutomationRun | undefined;
+    getRunInputSnapshot(id: string): SessionAutomationRunInputSnapshot | undefined;
+    getRunByInvocationId(invocationId: string): SessionAutomationRun | undefined;
+    getRunBySessionId(sessionId: string): SessionAutomationRun | undefined;
+    createRun(input: CreateSessionAutomationRunInput, now?: number): SessionAutomationRun;
+    beginRunBootstrap(id: string): SessionAutomationBootstrapClaim;
+    completeRunBootstrap(id: string, now?: number): SessionAutomationRun | undefined;
+    setRunStatus(id: string, status: Exclude<SessionAutomationRunStatus, "starting" | "failed">, now?: number): SessionAutomationRun | undefined;
+    markRunFailed(id: string, failureCode: string, now?: number): SessionAutomationRun | undefined;
+    listRuns(automationId?: string, limit?: number): SessionAutomationRun[];
+    close(): void;
+}
+interface OpenSessionAutomationStoreOptions {
+    dbPath: string;
+    generateAutomationId?: () => string;
+    generateRunId?: () => string;
+    loadDatabase?: () => typeof better_sqlite3;
+}
+declare class SessionAutomationRevisionConflictError extends Error {
+    readonly current: SessionAutomationDefinition;
+    constructor(current: SessionAutomationDefinition);
+}
+declare function openSessionAutomationStore(opts: OpenSessionAutomationStoreOptions): SessionAutomationStore;
+
+interface OwnerRef {
+    type: "person" | "organization";
+    id: string;
+}
+interface ProductContext {
+    kind: "personal" | "organization";
+    id: string;
+    name: string;
+}
+interface NodeAlias {
+    kind: "command-host" | "cloud-host" | "peer-host" | "direct-host" | "relay-route";
+    id: string;
+}
+interface NodeRecord {
+    id: string;
+    owner: OwnerRef;
+    name: string;
+    status: "online" | "offline" | "degraded";
+    platform: string;
+    lastSeenAt: number;
+    aliases: NodeAlias[];
+}
+type AgentRuntimeAuthState = "ready" | "required" | "unknown" | "error";
+interface AgentRuntimeRecord {
+    id: string;
+    nodeId: string;
+    provider: string;
+    displayName: string;
+    availability: "available" | "unavailable";
+    authState: AgentRuntimeAuthState;
+    version?: string;
+    capabilities: string[];
+    activeSessionCount: number;
+    observedAt: number;
+}
+interface NodeProjectionInput {
+    host: Pick<HostRecord, "id" | "label">;
+    owner: OwnerRef;
+    status: NodeRecord["status"];
+    platform: string;
+    lastSeenAt: number;
+    aliases?: readonly NodeAlias[];
+}
+interface AgentRuntimeDescriptor {
+    id: string;
+    displayName: string;
+    version?: string;
+    enabled?: boolean;
+    capabilities: Readonly<Record<string, boolean>>;
+}
+type ProviderValueMap<T> = Readonly<Record<string, T | undefined>> | ReadonlyMap<string, T>;
+interface AgentRuntimeProjectionInput {
+    nodeId: string;
+    descriptors: readonly AgentRuntimeDescriptor[];
+    availabilityByProvider: ProviderValueMap<ProviderAvailability>;
+    authStateByProvider?: ProviderValueMap<AgentRuntimeAuthState>;
+    activeSessionCountByProvider?: ProviderValueMap<number>;
+    /** Product-level capabilities that are intentionally outside the versioned adapter manifest contract. */
+    additionalCapabilitiesByProvider?: Readonly<Record<string, readonly string[] | undefined>>;
+    observedAt: number;
+}
+/** Map a canonical owner to the context label used by product navigation. */
+declare function productContextFromOwner(owner: OwnerRef, name: string): ProductContext;
+/** Recover the canonical owner reference without leaking presentation-only context fields. */
+declare function ownerFromProductContext(context: ProductContext): OwnerRef;
+/**
+ * Runtime ids are opaque because node and adapter ids can originate in different trust domains.
+ * JSON tuple framing prevents ambiguous concatenation, while base64url keeps the result route-safe.
+ */
+declare function agentRuntimeId(nodeId: string, provider: string): string;
+/** Project the persistent command host into the product Node model without changing its identity. */
+declare function projectNodeRecord(input: NodeProjectionInput): NodeRecord;
+/**
+ * Build the public runtime inventory from bounded provider facts. The projection deliberately picks
+ * fields instead of spreading descriptors or probes, so probe detail, paths, credentials, and option
+ * payloads cannot cross this boundary.
+ */
+declare function projectAgentRuntimeRecords(input: AgentRuntimeProjectionInput): AgentRuntimeRecord[];
+
 /**
  * Origin / CSWSH (cross-site WebSocket hijacking) guard for the WS upgrade and state-changing HTTP.
  *
@@ -3423,6 +5117,17 @@ declare class TerminalManager {
     private cleanupRecordPaths;
     private applyRuntimeSignal;
     write(id: string, data: string): void;
+    /**
+     * Start a newly-created automation Session and submit its task exactly once. `create()` is intentionally
+     * lazy, so writing before an attach would be a silent no-op; this method first owns a private attachment,
+     * waits for the provider TUI's idle composer (not merely a banner/auth/trust frame), then sends one bracketed
+     * paste and releases the attachment.
+     * The task never enters argv, logs, audit metadata, or a WebSocket URL.
+     */
+    bootstrapTask(id: string, task: string, options?: {
+        readyTimeoutMs?: number;
+        signal?: AbortSignal;
+    }): Promise<void>;
     resize(id: string, cols: number, rows: number): void;
     stop(id: string): void;
     get(id: string): TerminalMeta | undefined;
@@ -3782,6 +5487,8 @@ interface CreateServerDeps {
     commandStore?: CommandCenterStore;
     /** Durable idempotency, privacy-safe audit, and automation definitions/runs. */
     controlStore?: ControlStore;
+    /** Durable coding automations that launch real terminal Sessions on one exact Node/runtime/cwd. */
+    sessionAutomationStore?: SessionAutomationStore;
     /** Guarded git worktree lifecycle, confined to FS_ROOT and injectable for isolated tests. */
     worktreeService?: WorktreeService;
     /** Durable verified adapter/plugin package inventory. start.ts supplies a SQLite-backed manager. */
@@ -3885,12 +5592,16 @@ interface CreateServerDeps {
     wsTickets?: WsTicketStore;
     /** One-writer/many-observer terminal input coordinator. Injectable for deterministic multi-client tests. */
     inputLeases?: InputLeaseCoordinator;
+    /** Managed-cloud terminal authorization poll cadence. Injectable only so socket revocation tests stay fast. */
+    terminalAuthorizationRecheckMs?: number;
     /** Team policy seam: direct local mode permits confirmed takeover; enterprise policy can deny it here. */
     authorizeInputTakeover?: (principal: InputLeasePrincipal, sessionId: string) => boolean;
     /** Optional policy seam for acquiring/writing input. Team RBAC is applied in addition when enabled. */
     authorizeInputWrite?: (principal: InputLeasePrincipal, sessionId: string) => boolean;
     /** Durable team membership and role assignments. start.ts supplies SQLite; tests may inject memory. */
     teamStore?: TeamStore;
+    /** Additive local-team + signed-cloud authorization. Omit to preserve exact self-hosted TeamStore behavior. */
+    authorizer?: CompositeAuthorizer;
     /** Durable organization policy. Disabled by default; enforced uniformly when explicitly enabled. */
     policyStore?: PolicyStore;
     /** Durable, explicitly scoped host-to-host API connections. Raw peer credentials never leave this store. */
@@ -3901,11 +5612,53 @@ interface CreateServerDeps {
     presence?: PresenceCoordinator;
     /** Advertises and enforces that this host has an outbound blind-relay transport configured. */
     relayEnabled?: boolean;
+    /** Privacy-bounded connector health for the authenticated settings UI. */
+    relayStatus?: () => {
+        status: "idle" | "connecting" | "online" | "reconnecting" | "stopped";
+        activeChannels: number;
+        reconnects: number;
+    };
+    /** Privacy-safe managed-host sync status. Presence means cloud management is configured. */
+    cloudStatus?: () => CloudHostRuntimeStatus;
+    /** Signed managed-cloud authorization authority, used only for read-only Node grant projection. */
+    cloudAuthorizationStore?: CloudAuthorizationStore;
+    /** Managed ownership remains read-only/fail-closed even if its signed cloud store is temporarily unavailable. */
+    managedAuthorization?: boolean;
+    /** Canonical product ownership for this Node. Local installs default to the Personal context. */
+    nodeOwner?: OwnerRef;
+    /** Non-authoritative connection identifiers that resolve to this persistent command-host Node. */
+    nodeAliases?: readonly NodeAlias[];
+    /** Product context label; never used as an authorization decision. */
+    nodeOwnerName?: string;
     /** Optional hosted/self-hosted bootstrap; absent means relay works for already-provisioned devices only. */
     relayPairing?: RelayPairingBootstrap;
+    /**
+     * Optional hosted control-plane bridge. The request actor always comes from DeviceStore authentication;
+     * clients can supply only their one-use enrollment challenge.
+     */
+    cloudDeviceEnrollmentConfirmer?: CloudDeviceEnrollmentConfirmer;
     /** Late-bound host connector hook so device revocation closes relay channels immediately. */
     onDeviceRevoked?: (deviceId: string) => void;
 }
+type CloudStatusSyncState = "not-configured" | "syncing" | "healthy" | "pending" | "degraded" | "expired";
+type CloudStatusRecoveryAction = "none" | "wait-for-cloud-sync" | "wait-for-authorization-activation" | "check-host-connectivity" | "reauthorize-host" | "contact-organization-admin";
+interface CloudStatusResponse {
+    v: 1;
+    mode: "self-hosted" | "managed";
+    configured: boolean;
+    sync: {
+        state: CloudStatusSyncState;
+        lastSuccessfulAt: number | null;
+    };
+    authorization: {
+        status: "not-configured" | CloudHostRuntimeStatus["authorization"]["status"];
+        revision: number | null;
+        expiresAt: number | null;
+        expired: boolean;
+    };
+    action: CloudStatusRecoveryAction;
+}
+declare function cloudStatusResponse(status?: CloudHostRuntimeStatus): CloudStatusResponse;
 interface CreateServerResult {
     app: FastifyInstance;
     authGate: AuthGate;
@@ -3931,6 +5684,13 @@ interface CreateServerResult {
 }
 declare function createServer(config: ServerRuntimeConfig, deps?: CreateServerDeps): CreateServerResult;
 
+/** Hash of the intentionally inline boot-recovery watchdog in packages/web/index.html. */
+declare const PWA_BOOT_WATCHDOG_SHA256 = "sha256-tcgQYptaPeNGqJtts8Ft/5H4tf+s+jfSWQSguIhTp8k=";
+/**
+ * Static-shell policy shared by direct hosts and mirrored by packaging/relay/Caddyfile.
+ * Inline component styles remain necessary; executable inline code is restricted to the reviewed watchdog hash.
+ */
+declare const PWA_CONTENT_SECURITY_POLICY: string;
 /**
  * Server-side mirror of the web SW's `apiNavigationDenylist` (packages/web/src/pwa/sw-exclusions.ts),
  * EXTENDED with /health, /push and the /ws suffix. A request whose path matches one of these is a
@@ -4050,11 +5810,22 @@ declare function claudePreflightWarning(availability: ClaudeAvailability): strin
  * (the probe is short-timeout-guarded). Injectable probe + log sink so it's testable without a spawn.
  */
 declare function runClaudePreflight(probe: ClaudeVersionProbe, warn?: (msg: string) => void): Promise<void>;
-declare function startServer(env?: NodeJS.ProcessEnv): Promise<CreateServerResult & {
+interface StartServerOptions {
+    /** Shared control-plane transport seam for isolated embedding and startup tests. */
+    fetch?: typeof globalThis.fetch;
+}
+declare function cloudHostCapabilities(input: {
+    authorizationVersion: number;
+    terminalAvailable: boolean;
+    relayEnabled: boolean;
+    managedDeviceEnrollmentEnabled: boolean;
+}): string[];
+declare function startServer(env?: NodeJS.ProcessEnv, options?: StartServerOptions): Promise<CreateServerResult & {
     url: string;
     token?: string;
     tokenGenerated: boolean;
     relayHost?: RelayHostConnector;
+    cloudHostRuntime?: CloudHostRuntime;
 }>;
 
 interface ProcessLifecycleTarget {
@@ -4262,4 +6033,4 @@ declare function codexClassifierVersionWarning(codexVersion: string | undefined)
 
 declare const SERVER_PACKAGE = "@roamcode.ai/server";
 
-export { ADAPTER_CONTRACT_VERSION, API_PATH_DENYLIST, type AdapterCapabilityName, AdapterManifestError, type AdapterManifestV1, type AdapterPackageManifestV1, type AdapterRuntimeV1, type AdapterStateAuthority, type AgentActivity, type AgentProvider, type AgentRecord, type AttachSpawnOptions, type AttentionItem, type AttentionKind, type AttentionState, type AuditActorType, type AuditRecord, type AuditResult, type AuthCheckResult, AuthGate, type AuthGateOptions, type AutomationAction, type AutomationDefinition, type AutomationRun, type AutomationTrigger, BLIND_RELAY_DEFAULT_MAX_BYTES_PER_MINUTE, BLIND_RELAY_DEFAULT_MAX_CONNECTIONS_PER_ROUTE, BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES, BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE, BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES, BLIND_RELAY_PROTOCOL_VERSION, type Bar, type BlindRelayMetrics, type BlindRelayServer, CHECK_CACHE_MS, CLASSIFIER_TESTED_UP_TO, CLAUDE_LATEST_CACHE_MS, CLAUDE_VERSION_CACHE_MS, CLAUDE_VERSION_TIMEOUT_MS, CODEX_CLASSIFIER_TESTED_UP_TO, CODEX_EXECUTABLE_PROBE_TIMEOUT_MS, CODEX_OSC_MAX_CARRY, CONTROL_IDEMPOTENCY_TTL_MS, type CaptureOptions, type ChangelogEntry, type ClaudeAuthDeps, ClaudeAuthService, type ClaudeAuthStatus, type ClaudeAvailability, type ClaudeLatestDeps, ClaudeLatestService, type ClaudeMetadataRunner, ClaudeMetadataService, type ClaudeModelCatalogItem, type ClaudeSessionOptions, type ClaudeVersionProbe, type CodexAccount, CodexAppServerClient, type CodexAppServerClientOptions, type CodexDeviceLogin, type CodexExecutableDeps, type CodexExecutableProbe, type CodexExecutableResolution, type CodexInstallProvenance, CodexLatestService, type CodexLoginCompletion, type CodexLoginStatus, type CodexMetadataDiagnostics, type CodexMetadataRpc, CodexMetadataService, type CodexMetadataServiceOptions, type CodexModel, type CodexOscParser, type CodexProfileClientLifecycle, type CodexSessionOptions, type CodexSpawnLease, type CodexThreadInventoryEntry, type CodexThreadPersistence, CodexThreadResolver, type CodexThreadResolverOptions, type CodexUsage, type CodexVersionInfo, CommandCenterRevisionConflictError, type CommandCenterStore, type CommandCenterStoreMode, type CommandEvent, type CommandLayoutEnvelope, type ControlStore, type ControlStoreMode, type CreateAutomationInput, type CreateBlindRelayOptions, type CreateClaudeProviderOptions, type CreateCodexProfileClientLifecycleOptions, type CreateCodexProviderOptions, type CreateInstalledAdapterProviderOptions, type CreatePeerInput, type CreatePluginRuntimeOptions, type CreatePushDispatcherDeps, type CreateRelayAccountInput, type CreateServerDeps, type CreateServerResult, type CreateWebPushSendOptions, type CreateWorktreeInput, type CreateWorktreeResult, type CreateWorktreeServiceOptions, type DeviceEnrollment, type DeviceInfo, DevicePairingError, type DeviceRelayIdentity, type DeviceScope, type DeviceStore, type DirEntry, type DirListing, type DirSearchResult, type DurableRelayIdentity, type EnterprisePolicy, type EnterprisePolicyAction, type EnterprisePolicyContext, type EnterprisePolicyDecision, EnterprisePolicyRevisionConflictError, type EnterprisePolicyUpdate, ExtensionError, type ExtensionKind, type ExtensionManager, type ExtensionManifestV1, type ExtensionPolicyMode, type ExtensionTrust, type ExtensionVersionRecord, FETCH_TIMEOUT_MS, type FetchLatest, type FetchManifest, type FetchReleases, FsError, type FsErrorCode, FsService, type FsServiceOptions, type GitHubRelease, type HooksSettingsDocument, type HostRecord, INPUT_LEASE_TTL_MS, type IPty, type IdempotencyRecord, type InputLease, type InputLeaseAcquireResult, type InputLeaseActorType, InputLeaseCoordinator, type InputLeaseCoordinatorOptions, type InputLeaseEvent, type InputLeasePrincipal, type InstallExtensionInput, type InstallServiceContext, type InstallServiceResult, type InstallationKind, type InstalledExtension, type LaunchIntent, type LoopbackRelayHttpOptions, type LoopbackRelayTerminalOptions, type ManagedInstallOptions, type ManagedInstallResult, type ManagedInstallStatus, type ManagedPaths, type MarketplaceEntry, type McpConfigDocument, type ModelWeekBar, OPENAI_CODE_SIGNING_TEAM_ID, type OpenApiBuildOptions, type OpenCommandCenterStoreOptions, type OpenControlStoreOptions, type OpenDeviceStoreOptions, type OpenExtensionManagerOptions, type OpenPeerStoreOptions, type OpenPolicyStoreOptions, type OpenPushStoreOptions, type OpenRelayAccountStoreOptions, type OpenRelayRouteStoreOptions, type OpenSessionStoreOptions, type OpenTeamStoreOptions, type OriginCheckOptions, PAIRING_TTL_MS, PRESENCE_HEARTBEAT_MS, PRESENCE_TTL_MS, type PairingTicket, type PaneStatus, type PeerAction, type PeerConnection, type PeerJsonResponse, type PeerRecord, PeerRequestError, PeerRevisionConflictError, type PeerStatus, type PeerStore, type PeerStoreMode, type PersistedRelayHostConfig, type PluginAuditEvent, type PluginManifestV1, type PluginPermission, type PluginRunInput, type PluginRunResult, type PluginRuntime, PluginRuntimeError, type PolicyStore, type PolicyStoreMode, PresenceCoordinator, type PresenceCoordinatorOptions, type PresenceEvent, type PresenceHeartbeatInput, type PresenceMode, type PresenceRecord, type PresenceTarget, type ProcessLifecycleHandle, type ProcessLifecycleOptions, type ProcessLifecycleTarget, type ProcessSpec, type ProviderAdapterV1, type ProviderAvailability, ProviderError, type ProviderId, ProviderOptionsError, type ProviderProcessContext, ProviderRegistry, type ProviderRuntimeSignal, type ProviderRuntimeSignalParser, type ProviderSessionOptions, type PtySpawn, type PublicRelayRouteRecord, type PushDispatcher, type PushEvent, type PushEventKind, type PushPayload, type PushRecipient, type PushSendFn, type PushStore, type PushSubscriptionRecord, RELAY_CHANNEL_MAX_AGE_MS, RELAY_CHANNEL_MAX_FRAMES, RELAY_HANDSHAKE_MAX_SKEW_MS, RELAY_MAX_PLAINTEXT_BYTES, RELAY_PROTOCOL_VERSION, RELAY_RPC_MAX_BODY_BYTES, RELAY_RPC_MAX_PATH_BYTES, RELAY_WIRE_MAX_ENVELOPE_BYTES, RELAY_WIRE_PROTOCOL_VERSION, RUNNING_BUILD, RUNNING_VERSION, type RateLimitDecision, RateLimiter, type RateLimiterOptions, type RegisterStaticOptions, type RelayAccountPlan, type RelayAccountRecord, RelayAccountRevisionConflictError, type RelayAccountStatus, type RelayAccountStore, type RelayAccountStoreMode, type RelayChannelOptions, RelayCipherState, RelayCryptoError, type RelayCryptoErrorCode, type RelayDeviceProvisioner, type RelayDeviceProvisionerOptions, type RelayDeviceRouteRecord, type RelayDirection, type RelayEncryptedFrame, type RelayEphemeralKeyPair, type RelayFrameKind, type RelayHandshakeHello, type RelayHostConfigInput, type RelayHostConnector, type RelayHostConnectorOptions, type RelayHostMetrics, type RelayHostRuntimeConfig, type RelayHostStatus, type RelayHttpBridge, type RelayHttpHandlers, type RelayHttpOpenRequest, type RelayHttpOpener, type RelayHttpResponseHead, type RelayIdentity, type RelayIdentityStoreOptions, type RelayPairingBootstrap, type RelayPairingPackage, type RelayRole, type RelayRouteRecord, type RelayRouteStore, type RelayRpcMethod, type RelayRpcRequest, type RelayRpcResponse, type RelayStoreMode, type RelayTerminalBridge, type RelayTerminalHandlers, type RelayTerminalOpenRequest, type RelayTerminalOpener, type RelayWireEnvelope, type ReleaseRecord, type RenderLaunchdOptions, type RenderSystemdOptions, type ResolveAccessTokenOptions, type ResolveCodexExecutableOptions, type ResolveCodexThreadOptions, type ResolveVapidKeysOptions, type ReturnTypeOfDescriptors, type RunClaudeVersion, type RunUsage, SEARCH_MAX_DEPTH, SEARCH_MAX_DIRS, SEARCH_MAX_RESULTS, SERVER_PACKAGE, SHELL_PATH_ALLOWLIST, type ServerConfig, type ServerRuntimeConfig, type ServiceRecord, type SessionDefaults, SessionDefaultsConflictError, type SessionFileDirection, type SessionFileKind, type SessionFileStorage, type SessionPlacement, type SessionStore, type StartedBlindRelay, type StoreMode, type StoredExternalSession, type StoredSession, type StoredSessionDefaults, type StoredSessionFile, type StoredStatus, type TeamAuthorizationDecision, type TeamAuthorizationResource, type TeamMember, type TeamMemberKind, type TeamMemberStatus, type TeamPermission, type TeamPrincipalBinding, type TeamPrincipalType, type TeamRecord, TeamRevisionConflictError, type TeamRole, type TeamRoleBinding, type TeamScopeType, type TeamStore, type TeamStoreMode, TerminalManager, type TerminalManagerDeps, type TerminalMeta, TerminalProcess, type TerminalProcessOptions, type TerminalSub, USAGE_CACHE_MS, USAGE_TIMEOUT_MS, type UpdateAction, type UpdateAutomationInput, type UpdatePeerInput, type UpdatePolicyMode, type UpdateRelayAccountInput, type UpdateState, type UpdateStatus, Updater, type UpdaterDeps, type UpdaterFs, type UsageInfo, UsageService, type UsageServiceDeps, type VapidKeys, type VerifiedPeerIdentity, type VersionInfo, WS_TICKET_TTL_MS, type WorkspaceKind, type WorkspaceRecord, WorktreeError, type WorktreeErrorCode, type WorktreeRecord, type WorktreeService, type WsTicketContext, WsTicketStore, type WsTicketStoreOptions, adapterCapabilityNames, assertConfigAllowsStart, buildCodexArgs, buildHooksSettingsDocument, buildMcpConfigDocument, buildOpenApiDocument, buildPushPayload, buildRelayPairingUrl, buildServicePath, capturePane, classifierVersionWarning, classifyCodexPane, classifyPaneStatus, claudePreflightWarning, codexClassifierVersionWarning, compareVersions, computeBuildDrift, computeInstallDrift, createBlindRelayServer, createClaudeAuthService, createClaudeLatestService, createClaudeMetadataRunner, createClaudeProvider, createClaudeVersionProbe, createCodexOscParser, createCodexProfileClientLifecycle, createCodexProvider, createCodexThreadInventory, createCodexThreadPersistence, createInstalledAdapterProvider, createLoopbackRelayHttpOpener, createLoopbackRelayTerminalOpener, createPluginRuntime, createPushDispatcher, createRelayDeviceProvisioner, createRelayHandshakeHello, createRelayHostConnector, createServer, createUpdater, createUsageRunner, createUsageService, createWebPushSend, createWorktreeService, currentAgentIdForSession, decodeRelayWireEnvelope, defaultFetchManifest, defaultFetchReleases, defaultProbeCodexExecutable, defaultRunClaudeVersion, defaultUpdaterFs, defineAdapterManifest, detectTerminalSupport, enableService, encodeRelayWireEnvelope, ensureDataDir, establishRelayChannel, evaluateEnterprisePolicy, extractBearerToken, extractLoginUrl, generateAccessToken, generateRelayAccountCredential, generateRelayCredential, generateRelayEphemeralKeyPair, generateRelayIdentity, hasEncodedSep, hkdfSha256, hookAuthFileContent, hookAuthPathFor, hooksSettingsPathFor, inspectExtensionPackage, installManagedRelease, installProcessLifecycle, installService, isCodexProfileClientLifecycle, isLoopbackAddress, isNewerMajorMinor, isOriginAllowed, isPublicForRequest, isPublicPath, isRelayDirectExecution, isShellPath, isStableVersion, isTeamRole, isTeamScopeType, listTmuxSessions, loadConfig, loadOrCreateRelayIdentity, loadServerConfig, looksLikeAssetRequest, managedPaths, mcpConfigPathFor, migrateServiceToLauncher, normalizeAutomationAction, normalizeAutomationInput, normalizeAutomationTrigger, normalizeCommandCenterLabel, normalizeDeviceName, normalizeDeviceScopes, normalizeOrigin, normalizePeerBaseUrl, normalizeProviderAvailability, normalizeRelayAppUrl, normalizeRelease, normalizeSessionDefaults, openCommandCenterStore, openControlStore, openDeviceStore, openExtensionManager, openPeerStore, openPolicyStore, openPushStore, openRelayAccountStore, openRelayRouteStore, openSessionStore, openTeamStore, parseAllowedOrigins, parseAuthStatus, parseClaudeVersion, parseCodexOscNotifications, parseCodexVersion, parseLegacyClaudeArgs, parseMarketplaceIndex, parseNpmLatest, parseProviderOptions, parseRelayRpcRequest, parseReleaseNotes, parseUsage, pathForGate, persistAccessToken, privacySafeAuditMetadata, providerPreflightWarning, publicAdapterDescriptor, readActiveVersion, readPreviousVersion, readRelayHostConfig, readServiceRecord, registerStatic, relativeWhen, relayAccountCredentialHash, relayAccountCredentialLookup, relayConnectUrl, relayCredentialHash, relayHostConfigPath, relayIdentityFingerprint, relayRpcResponse, removeRelayHostConfig, renderLaunchdPlist, renderManagedLauncher, renderSystemdUnit, requestPeerJson, resetCodexThreadResolutionCoordinatorForTests, resolveAccessToken, resolveCodexExecutable, resolveDataDir, resolveInstallRoot, resolveRelayHostConfig, resolveVapidKeys, restartService, runClaudePreflight, runProviderPreflight, safeProcessErrorSummary, searchMarketplace, stableReleases, startBlindRelay, startServer, teamRolePermissions, tmuxSessionName, validateAdapterManifest, validateAdapterOptionSchema, validateRelayIdentity, verifyPeerConnection, verifyRelayHandshakeHello, writeManagedLauncher, writeRelayHostConfig };
+export { ADAPTER_CONTRACT_VERSION, API_PATH_DENYLIST, type AdapterCapabilityName, AdapterManifestError, type AdapterManifestV1, type AdapterPackageManifestV1, type AdapterRuntimeV1, type AdapterStateAuthority, type AgentActivity, type AgentProvider, type AgentRecord, type AgentRuntimeAuthState, type AgentRuntimeRecord, type AttachSpawnOptions, type AttentionItem, type AttentionKind, type AttentionState, type AuditActorType, type AuditRecord, type AuditResult, type AuthCheckResult, AuthGate, type AuthGateOptions, type AutomationAction, type AutomationDefinition, type AutomationRun, type AutomationTrigger, BLIND_RELAY_DEFAULT_MAX_BYTES_PER_MINUTE, BLIND_RELAY_DEFAULT_MAX_CONNECTIONS_PER_ROUTE, BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES, BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE, BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES, BLIND_RELAY_DEFAULT_MAX_TOTAL_CONNECTIONS, BLIND_RELAY_PROTOCOL_VERSION, type Bar, type BlindRelayMetrics, type BlindRelayServer, CHECK_CACHE_MS, CLASSIFIER_TESTED_UP_TO, CLAUDE_LATEST_CACHE_MS, CLAUDE_VERSION_CACHE_MS, CLAUDE_VERSION_TIMEOUT_MS, CLOUD_AUTHORIZATION_CLOCK_SKEW_MS, CLOUD_AUTHORIZATION_CONTRACT_VERSION, CLOUD_AUTHORIZATION_FILE, CLOUD_AUTHORIZATION_KEYSET_PATH, CLOUD_AUTHORIZATION_KEYSET_SIGNATURE_DOMAIN, CLOUD_AUTHORIZATION_KEYSET_SIGNATURE_DOMAIN_V2, CLOUD_AUTHORIZATION_LAST_GOOD_FILE, CLOUD_AUTHORIZATION_PERMISSIONS, CLOUD_AUTHORIZATION_SIGNATURE_ALGORITHM, CLOUD_AUTHORIZATION_SIGNATURE_ALGORITHM_V2, CLOUD_AUTHORIZATION_SIGNATURE_DOMAIN, CLOUD_AUTHORIZATION_SIGNATURE_DOMAIN_V2, CLOUD_CONTRACT_VERSION, CLOUD_DEVICE_ENROLLMENT_COMPLETE_PATH, CLOUD_DEVICE_ENROLLMENT_CONFIRM_PATH, CLOUD_DEVICE_ENROLLMENT_HOST_ROUTE, CLOUD_HOST_AUTHORIZATION_SNAPSHOT_PATH, CLOUD_HOST_CONFIG_FILE, CLOUD_HOST_HEARTBEAT_PATH, CLOUD_HOST_MAX_SIGNED_RESPONSE_BYTES, CLOUD_KEYSET_CLOCK_SKEW_MS, CODEX_CLASSIFIER_TESTED_UP_TO, CODEX_EXECUTABLE_PROBE_TIMEOUT_MS, CODEX_OSC_MAX_CARRY, CONTROL_IDEMPOTENCY_TTL_MS, type CaptureOptions, type ChangelogEntry, type ClaudeAuthDeps, ClaudeAuthService, type ClaudeAuthStatus, type ClaudeAvailability, type ClaudeLatestDeps, ClaudeLatestService, type ClaudeMetadataRunner, ClaudeMetadataService, type ClaudeModelCatalogItem, type ClaudeSessionOptions, type ClaudeVersionProbe, type CloudAuthorizationDecision, type CloudAuthorizationGrantV1, CloudAuthorizationGrantV1Schema, type CloudAuthorizationKeyset, type CloudAuthorizationKeysetKey, type CloudAuthorizationKeysetKeyV1, CloudAuthorizationKeysetKeyV1Schema, type CloudAuthorizationKeysetKeyV2, CloudAuthorizationKeysetKeyV2Schema, CloudAuthorizationKeysetSchema, type CloudAuthorizationKeysetV1, CloudAuthorizationKeysetV1Schema, type CloudAuthorizationKeysetV2, CloudAuthorizationKeysetV2Schema, type CloudAuthorizationPermission, CloudAuthorizationPermissionSchema, type CloudAuthorizationPrincipalType, type CloudAuthorizationScopeV1, CloudAuthorizationScopeV1Schema, type CloudAuthorizationSnapshot, CloudAuthorizationSnapshotSchema, type CloudAuthorizationSnapshotStatus, type CloudAuthorizationSnapshotV1, CloudAuthorizationSnapshotV1Schema, type CloudAuthorizationSnapshotV2, CloudAuthorizationSnapshotV2Schema, type CloudAuthorizationState, type CloudAuthorizationStore, CloudAuthorizationStoreError, type CloudAuthorizationStoreErrorCode, type CloudAuthorizationTrustedKey, CloudAuthorizationTrustedKeyAnySchema, CloudAuthorizationTrustedKeySchema, type CloudAuthorizationTrustedKeyV1, type CloudAuthorizationTrustedKeyV2, CloudAuthorizationTrustedKeyV2Schema, CloudAuthorizationVerificationError, type CloudAuthorizationVerificationErrorCode, type CloudDeviceEnrollmentConfirmationResult, type CloudDeviceEnrollmentConfirmer, CloudDeviceEnrollmentConflictError, CloudDeviceEnrollmentError, type CloudDeviceEnrollmentErrorCode, type CloudDeviceEnrollmentPrepareInput, type CloudDeviceEnrollmentProgress, type CloudDeviceEnrollmentRecoveryLoop, type CloudDeviceEnrollmentRequest, CloudDeviceEnrollmentRequestSchema, type CloudDeviceEnrollmentRuntimeConfig, type CloudDeviceEnrollmentState, type CloudHostAuthorizationIssue, type CloudHostConfig, CloudHostConfigSchema, type CloudHostConfigV1, CloudHostConfigV1Schema, type CloudHostConfigV2, CloudHostConfigV2Schema, type CloudHostDeviceEnrollmentCompletion, type CloudHostDeviceEnrollmentCompletionResult, CloudHostDeviceEnrollmentCompletionSchema, type CloudHostDeviceEnrollmentConfirmation, CloudHostDeviceEnrollmentConfirmationSchema, type CloudHostHeartbeatV1, CloudHostHeartbeatV1Schema, type CloudHostRuntime, CloudHostRuntimeError, type CloudHostRuntimeErrorCode, type CloudHostRuntimeStatus, CloudKeysetVerificationError, type CloudKeysetVerificationErrorCode, type CloudRelayDeviceEnrollmentAuth, CloudRelayDeviceEnrollmentAuthSchema, type CloudRelayDeviceEnrollmentPayload, CloudRelayDeviceEnrollmentPayloadSchema, type CloudRelayDeviceEnrollmentSaga, type CloudStatusRecoveryAction, type CloudStatusResponse, type CloudStatusSyncState, type CodexAccount, CodexAppServerClient, type CodexAppServerClientOptions, type CodexDeviceLogin, type CodexExecutableDeps, type CodexExecutableProbe, type CodexExecutableResolution, type CodexInstallProvenance, CodexLatestService, type CodexLoginCompletion, type CodexLoginStatus, type CodexMetadataDiagnostics, type CodexMetadataRpc, CodexMetadataService, type CodexMetadataServiceOptions, type CodexModel, type CodexOscParser, type CodexProfileClientLifecycle, type CodexSessionOptions, type CodexSpawnLease, type CodexThreadInventoryEntry, type CodexThreadPersistence, CodexThreadResolver, type CodexThreadResolverOptions, type CodexUsage, type CodexVersionInfo, CommandCenterRevisionConflictError, type CommandCenterStore, type CommandCenterStoreMode, type CommandEvent, type CommandLayoutEnvelope, type CompositeAuthorizationDecision, type CompositeAuthorizationReason, type CompositeAuthorizer, type ControlStore, type ControlStoreMode, type CreateAutomationInput, type CreateBlindRelayOptions, type CreateClaudeProviderOptions, type CreateCloudDeviceEnrollmentConfirmerOptions, type CreateCloudDeviceEnrollmentRecoveryLoopOptions, type CreateCloudHostRuntimeOptions, type CreateCloudRelayDeviceEnrollmentSagaOptions, type CreateCodexProfileClientLifecycleOptions, type CreateCodexProviderOptions, type CreateCompositeAuthorizerOptions, type CreateInstalledAdapterProviderOptions, type CreatePeerInput, type CreatePluginRuntimeOptions, type CreatePushDispatcherDeps, type CreateRelayAccountInput, type CreateServerDeps, type CreateServerResult, type CreateSessionAutomationInput, type CreateSessionAutomationRunInput, type CreateWebPushSendOptions, type CreateWorktreeInput, type CreateWorktreeResult, type CreateWorktreeServiceOptions, DEFAULT_CLOUD_CONTROL_PLANE_URL, type DeviceEnrollment, type DeviceInfo, DevicePairingError, type DeviceRelayIdentity, type DeviceScope, type DeviceStore, type DirEntry, type DirListing, type DirSearchResult, type DurableRelayIdentity, type EnterprisePolicy, type EnterprisePolicyAction, type EnterprisePolicyContext, type EnterprisePolicyDecision, EnterprisePolicyRevisionConflictError, type EnterprisePolicyUpdate, ExtensionError, type ExtensionKind, type ExtensionManager, type ExtensionManifestV1, type ExtensionPolicyMode, type ExtensionTrust, type ExtensionVersionRecord, FETCH_TIMEOUT_MS, type FetchLatest, type FetchManifest, type FetchReleases, FsError, type FsErrorCode, FsService, type FsServiceOptions, type GitHubRelease, type HooksSettingsDocument, type HostRecord, INPUT_LEASE_TTL_MS, type IPty, type IdempotencyRecord, type InputLease, type InputLeaseAcquireResult, type InputLeaseActorType, InputLeaseCoordinator, type InputLeaseCoordinatorOptions, type InputLeaseEvent, type InputLeasePrincipal, type InstallExtensionInput, type InstallServiceContext, type InstallServiceResult, type InstallationKind, type InstalledExtension, type LaunchIntent, type LoopbackRelayHttpOptions, type LoopbackRelayTerminalOptions, type ManagedInstallOptions, type ManagedInstallResult, type ManagedInstallStatus, type ManagedPaths, type MarketplaceEntry, type McpConfigDocument, type ModelWeekBar, type NodeAlias, type NodeRecord, OPENAI_CODE_SIGNING_TEAM_ID, type OpenApiBuildOptions, type OpenCloudAuthorizationStoreOptions, type OpenCommandCenterStoreOptions, type OpenControlStoreOptions, type OpenDeviceStoreOptions, type OpenExtensionManagerOptions, type OpenPeerStoreOptions, type OpenPolicyStoreOptions, type OpenPushStoreOptions, type OpenRelayAccountStoreOptions, type OpenRelayRouteStoreOptions, type OpenSessionAutomationStoreOptions, type OpenSessionStoreOptions, type OpenTeamStoreOptions, type OriginCheckOptions, type OwnerRef, PAIRING_TTL_MS, PRESENCE_HEARTBEAT_MS, PRESENCE_TTL_MS, PWA_BOOT_WATCHDOG_SHA256, PWA_CONTENT_SECURITY_POLICY, type PairingTicket, type PaneStatus, type PeerAction, type PeerConnection, type PeerJsonResponse, type PeerRecord, PeerRequestError, PeerRevisionConflictError, type PeerStatus, type PeerStore, type PeerStoreMode, type PendingCloudDevicePromotion, type PersistedRelayHostConfig, type PluginAuditEvent, type PluginManifestV1, type PluginPermission, type PluginRunInput, type PluginRunResult, type PluginRuntime, PluginRuntimeError, type PolicyStore, type PolicyStoreMode, PresenceCoordinator, type PresenceCoordinatorOptions, type PresenceEvent, type PresenceHeartbeatInput, type PresenceMode, type PresenceRecord, type PresenceTarget, type ProcessLifecycleHandle, type ProcessLifecycleOptions, type ProcessLifecycleTarget, type ProcessSpec, type ProductContext, type ProviderAdapterV1, type ProviderAvailability, ProviderError, type ProviderId, ProviderOptionsError, type ProviderProcessContext, ProviderRegistry, type ProviderRuntimeSignal, type ProviderRuntimeSignalParser, type ProviderSessionOptions, type PtySpawn, type PublicRelayRouteRecord, type PushDispatcher, type PushEvent, type PushEventKind, type PushPayload, type PushRecipient, type PushSendFn, type PushStore, type PushSubscriptionRecord, RELAY_CHANNEL_MAX_AGE_MS, RELAY_CHANNEL_MAX_FRAMES, RELAY_HANDSHAKE_MAX_SKEW_MS, RELAY_MAX_PLAINTEXT_BYTES, RELAY_PROTOCOL_VERSION, RELAY_RPC_MAX_BODY_BYTES, RELAY_RPC_MAX_PATH_BYTES, RELAY_WIRE_MAX_ENVELOPE_BYTES, RELAY_WIRE_PROTOCOL_VERSION, RUNNING_BUILD, RUNNING_VERSION, type RateLimitDecision, RateLimiter, type RateLimiterOptions, type RegisterStaticOptions, type RelayAccountCredentialInput, type RelayAccountCredentialMaterial, type RelayAccountPlan, type RelayAccountRecord, RelayAccountRevisionConflictError, type RelayAccountStatus, type RelayAccountStore, type RelayAccountStoreMode, type RelayChannelOptions, RelayCipherState, RelayCryptoError, type RelayCryptoErrorCode, type RelayDeviceProvisioner, type RelayDeviceProvisionerOptions, type RelayDeviceRouteRecord, type RelayDirection, type RelayEncryptedFrame, type RelayEphemeralKeyPair, type RelayFrameKind, type RelayHandshakeHello, type RelayHostConfigInput, type RelayHostConnector, type RelayHostConnectorOptions, type RelayHostMetrics, type RelayHostRuntimeConfig, type RelayHostStatus, type RelayHttpBridge, type RelayHttpHandlers, type RelayHttpOpenRequest, type RelayHttpOpener, type RelayHttpResponseHead, type RelayIdentity, type RelayIdentityStoreOptions, type RelayPairingBootstrap, type RelayPairingPackage, type RelayRole, type RelayRouteRecord, type RelayRouteStore, type RelayRpcMethod, type RelayRpcRequest, type RelayRpcResponse, type RelayStoreMode, type RelayTerminalBridge, type RelayTerminalHandlers, type RelayTerminalOpenRequest, type RelayTerminalOpener, type RelayWireEnvelope, type ReleaseRecord, type RenderLaunchdOptions, type RenderSystemdOptions, type ResolveAccessTokenOptions, type ResolveCodexExecutableOptions, type ResolveCodexThreadOptions, type ResolveVapidKeysOptions, type ResolvedCloudHostConfig, type ReturnTypeOfDescriptors, type RunClaudeVersion, type RunUsage, SEARCH_MAX_DEPTH, SEARCH_MAX_DIRS, SEARCH_MAX_RESULTS, SERVER_PACKAGE, SHELL_PATH_ALLOWLIST, type ServerConfig, type ServerRuntimeConfig, type ServiceRecord, type SessionAutomationDefinition, SessionAutomationRevisionConflictError, type SessionAutomationRun, type SessionAutomationRunStatus, type SessionAutomationStore, type SessionAutomationStoreMode, type SessionAutomationTrigger, type SessionDefaults, SessionDefaultsConflictError, type SessionFileDirection, type SessionFileKind, type SessionFileStorage, type SessionPlacement, type SessionStore, type SignedCloudAuthorizationKeyset, SignedCloudAuthorizationKeysetSchema, SignedCloudAuthorizationKeysetSignatureV1Schema, SignedCloudAuthorizationKeysetSignatureV2Schema, type SignedCloudAuthorizationKeysetV1, SignedCloudAuthorizationKeysetV1Schema, type SignedCloudAuthorizationKeysetV2, SignedCloudAuthorizationKeysetV2Schema, type SignedCloudAuthorizationSnapshot, SignedCloudAuthorizationSnapshotSchema, type SignedCloudAuthorizationSnapshotV1, SignedCloudAuthorizationSnapshotV1Schema, type SignedCloudAuthorizationSnapshotV2, SignedCloudAuthorizationSnapshotV2Schema, type StartServerOptions, type StartedBlindRelay, type StoreMode, type StoredCloudAuthorizationSnapshot, type StoredExternalSession, type StoredSession, type StoredSessionDefaults, type StoredSessionFile, type StoredStatus, type TeamAuthorizationDecision, type TeamAuthorizationResource, type TeamMember, type TeamMemberKind, type TeamMemberStatus, type TeamPermission, type TeamPrincipalBinding, type TeamPrincipalType, type TeamRecord, TeamRevisionConflictError, type TeamRole, type TeamRoleBinding, type TeamScopeType, type TeamStore, type TeamStoreMode, TerminalManager, type TerminalManagerDeps, type TerminalMeta, TerminalProcess, type TerminalProcessOptions, type TerminalSub, USAGE_CACHE_MS, USAGE_TIMEOUT_MS, type UpdateAction, type UpdateAutomationInput, type UpdatePeerInput, type UpdatePolicyMode, type UpdateRelayAccountInput, type UpdateSessionAutomationInput, type UpdateState, type UpdateStatus, Updater, type UpdaterDeps, type UpdaterFs, type UsageInfo, UsageService, type UsageServiceDeps, type VapidKeys, type VerifiedPeerIdentity, type VersionInfo, WS_TICKET_TTL_MS, type WorkspaceKind, type WorkspaceRecord, WorktreeError, type WorktreeErrorCode, type WorktreeRecord, type WorktreeService, type WsTicketContext, WsTicketStore, type WsTicketStoreOptions, adapterCapabilityNames, agentRuntimeId, assertConfigAllowsStart, buildCodexArgs, buildHooksSettingsDocument, buildMcpConfigDocument, buildOpenApiDocument, buildPushPayload, buildRelayPairingUrl, buildServicePath, canonicalCloudJson, capturePane, classifierVersionWarning, classifyCodexPane, classifyPaneStatus, claudePreflightWarning, cloudAuthorizationKeysetSigningPayload, cloudAuthorizationSnapshotSigningPayload, cloudAuthorizationTrustedKeysFromKeyset, cloudDeviceEnrollmentAuthorizationReady, cloudHostCapabilities, cloudHostConfigPath, cloudStatusResponse, codexClassifierVersionWarning, compareVersions, computeBuildDrift, computeInstallDrift, createBlindRelayServer, createClaudeAuthService, createClaudeLatestService, createClaudeMetadataRunner, createClaudeProvider, createClaudeVersionProbe, createCloudDeviceEnrollmentConfirmer, createCloudDeviceEnrollmentRecoveryLoop, createCloudHostRuntime, createCloudRelayDeviceEnrollmentSaga, createCodexOscParser, createCodexProfileClientLifecycle, createCodexProvider, createCodexThreadInventory, createCodexThreadPersistence, createCompositeAuthorizer, createInstalledAdapterProvider, createLoopbackRelayHttpOpener, createLoopbackRelayTerminalOpener, createPluginRuntime, createPushDispatcher, createRelayDeviceProvisioner, createRelayHandshakeHello, createRelayHostConnector, createServer, createUpdater, createUsageRunner, createUsageService, createWebPushSend, createWorktreeService, currentAgentIdForSession, decodeRelayWireEnvelope, defaultFetchManifest, defaultFetchReleases, defaultProbeCodexExecutable, defaultRunClaudeVersion, defaultUpdaterFs, defineAdapterManifest, detectTerminalSupport, enableService, encodeRelayWireEnvelope, ensureDataDir, establishRelayChannel, evaluateEnterprisePolicy, extractBearerToken, extractLoginUrl, generateAccessToken, generateRelayAccountCredential, generateRelayCredential, generateRelayEphemeralKeyPair, generateRelayIdentity, hasEncodedSep, hkdfSha256, hookAuthFileContent, hookAuthPathFor, hooksSettingsPathFor, inspectExtensionPackage, installManagedRelease, installProcessLifecycle, installService, isCodexProfileClientLifecycle, isLoopbackAddress, isNewerMajorMinor, isOriginAllowed, isPublicForRequest, isPublicPath, isRelayDirectExecution, isShellPath, isStableVersion, isTeamRole, isTeamScopeType, listTmuxSessions, loadConfig, loadOrCreateRelayIdentity, loadServerConfig, looksLikeAssetRequest, managedPaths, mcpConfigPathFor, migrateServiceToLauncher, normalizeAutomationAction, normalizeAutomationInput, normalizeAutomationTrigger, normalizeCloudControlPlaneOrigin, normalizeCommandCenterLabel, normalizeDeviceName, normalizeDeviceScopes, normalizeOrigin, normalizePeerBaseUrl, normalizeProviderAvailability, normalizeRelayAppUrl, normalizeRelease, normalizeSessionDefaults, openCloudAuthorizationStore, openCommandCenterStore, openControlStore, openDeviceStore, openExtensionManager, openPeerStore, openPolicyStore, openPushStore, openRelayAccountStore, openRelayRouteStore, openSessionAutomationStore, openSessionStore, openTeamStore, ownerFromProductContext, parseAllowedOrigins, parseAuthStatus, parseClaudeVersion, parseCloudAuthorizationKeyset, parseCloudAuthorizationSnapshot, parseCloudHostHeartbeat, parseCodexOscNotifications, parseCodexVersion, parseLegacyClaudeArgs, parseMarketplaceIndex, parseNpmLatest, parseProviderOptions, parseRelayRpcRequest, parseReleaseNotes, parseSignedCloudAuthorizationSnapshot, parseUsage, pathForGate, persistAccessToken, privacySafeAuditMetadata, productContextFromOwner, projectAgentRuntimeRecords, projectNodeRecord, providerPreflightWarning, publicAdapterDescriptor, readActiveVersion, readCloudHostConfig, readCloudHostCredentialFile, readPreviousVersion, readRelayHostConfig, readServiceRecord, registerStatic, relativeWhen, relayAccountCredentialHash, relayAccountCredentialLookup, relayConnectUrl, relayCredentialHash, relayHostConfigPath, relayIdentityFingerprint, relayRpcResponse, removeCloudHostConfig, removeRelayHostConfig, renderLaunchdPlist, renderManagedLauncher, renderSystemdUnit, replaceCloudHostAuthorizationKeyset, requestPeerJson, resetCodexThreadResolutionCoordinatorForTests, resolveAccessToken, resolveCloudDeviceEnrollmentConfig, resolveCloudHostConfig, resolveCodexExecutable, resolveDataDir, resolveInstallRoot, resolveRelayHostConfig, resolveVapidKeys, restartService, runClaudePreflight, runProviderPreflight, safeProcessErrorSummary, searchMarketplace, stableReleases, startBlindRelay, startServer, teamRolePermissions, tmuxSessionName, validateAdapterManifest, validateAdapterOptionSchema, validateRelayIdentity, verifyPeerConnection, verifyRelayHandshakeHello, verifySignedCloudAuthorizationKeyset, verifySignedCloudAuthorizationSnapshot, writeCloudHostConfig, writeManagedLauncher, writeRelayHostConfig };